🚨(app-desk) add duration on TextErrors component

Add a duration on the TextErrors component.
I will display the error message the time specified
in the `duration` prop.
By default the errors will be displayed 6 seconds.

.dockerignore

@@ -31,6 +31,3 @@ db.sqlite3
 .mypy_cache
 .pylint.d
 .pytest_cache
-
-# Frontend dependencies
-node_modules

.gitattributes

@@ -1,24 +0,0 @@
-# Set the default behavior for all files
-* text=auto eol=lf
-
-# Binary files (should not be modified)
-*.png binary
-*.jpg binary
-*.jpeg binary
-*.gif binary
-*.ico binary
-*.mov binary
-*.mp4 binary
-*.mp3 binary
-*.flv binary
-*.fla binary
-*.swf binary
-*.gz binary
-*.zip binary
-*.7z binary
-*.ttf binary
-*.woff binary
-*.woff2 binary
-*.eot binary
-*.pdf binary
-

.github/ISSUE_TEMPLATE/Support_question.md

@@ -9,9 +9,9 @@ We primarily use GitHub as an issue tracker. If however you're encountering an i
 
 ---
 
-Please make sure you have read our [main Readme](https://github.com/suitenumerique/people).
+Please make sure you have read our [main Readme](https://github.com/numerique-gouv/people).
 
-Also make sure it was not already answered in [an open or close issue](https://github.com/suitenumerique/people/issues).
+Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/people/issues).
 
 If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
 

.github/workflows/crowdin_download.yml

@@ -1,77 +0,0 @@
-name: Download translations from Crowdin
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - 'release/**'
-
-jobs:
-  install-dependencies:
-    uses: ./.github/workflows/dependencies.yml
-    with:
-      node_version: '22.x'
-      with-front-dependencies-installation: true
-
-  synchronize-with-crowdin:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Create empty source files
-        run: |
-          touch src/backend/locale/django.pot
-          mkdir -p src/frontend/packages/i18n/locales/desk/
-          touch src/frontend/packages/i18n/locales/desk/translations-crowdin.json
-      # crowdin workflow
-      - name: crowdin action
-        uses: crowdin/github-action@v2
-        with:
-          config: crowdin/config.yml
-          upload_sources: false
-          upload_translations: false
-          download_translations: true
-          create_pull_request: false
-          push_translations: false
-          push_sources: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # A numeric ID, found at https://crowdin.com/project/<projectName>/tools/api
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-
-          # Visit https://crowdin.com/settings#api-key to create this token
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
-
-          CROWDIN_BASE_PATH: "../src/"
-      # frontend i18n
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        with:
-          path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-          fail-on-cache-miss: true
-      - name: generate translations files
-        working-directory: src/frontend
-        run: yarn i18n:deploy
-      # Create a new PR
-      - name: Create a new Pull Request with new translated strings
-        uses: peter-evans/create-pull-request@v7
-        with:
-          commit-message: |
-            🌐(i18n) update translated strings
-
-            Update translated files with new translations
-          title: 🌐(i18n) update translated strings
-          body: |
-            ## Purpose
-
-            update translated strings
-
-            ## Proposal
-
-            - [x]  update translated strings
-          branch: i18n/update-translations
-          labels: i18n

.github/workflows/crowdin_upload.yml

@@ -1,76 +0,0 @@
-name: Update crowdin sources
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-jobs:
-  install-dependencies:
-    uses: ./.github/workflows/dependencies.yml
-    with:
-      node_version: '22.x'
-      with-front-dependencies-installation: true
-      with-build_mails: true
-
-  synchronize-with-crowdin:
-    needs: install-dependencies
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      # Backend i18n
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version-file: "src/backend/pyproject.toml"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-      - name: Install the project
-        run: uv sync --locked --all-extras
-        working-directory: src/backend
-      - name: Restore the mail templates
-        uses: actions/cache@v5
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-          fail-on-cache-miss: true
-      - name: Install gettext
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext pandoc
-      - name: generate pot files
-        working-directory: src/backend
-        run: |
-          DJANGO_CONFIGURATION=Build uv run python manage.py makemessages -a --keep-pot
-      # frontend i18n
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        with:
-          path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-          fail-on-cache-miss: true
-      - name: generate source translation file
-        working-directory: src/frontend
-        run: yarn i18n:extract
-      # crowdin workflow
-      - name: crowdin action
-        uses: crowdin/github-action@v2
-        with:
-          config: crowdin/config.yml
-          upload_sources: true
-          upload_translations: false
-          download_translations: false
-          create_pull_request: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # A numeric ID, found at https://crowdin.com/project/<projectName>/tools/api
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-
-          # Visit https://crowdin.com/settings#api-key to create this token
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
-
-          CROWDIN_BASE_PATH: "../src/"

.github/workflows/dependencies.yml

@@ -1,85 +0,0 @@
-name: Dependency reusable workflow
-
-on:
-  workflow_call:
-    inputs:
-      node_version:
-        required: false
-        default: '22.x'
-        type: string
-      with-front-dependencies-installation:
-        type: boolean
-        default: false
-      with-build_mails:
-        type: boolean
-        default: false
-
-jobs:
-  front-dependencies-installation:
-    if: ${{ inputs.with-front-dependencies-installation == true }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        id: front-node_modules
-        with:
-          path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-      - name: Setup Node.js
-        if: steps.front-node_modules.outputs.cache-hit != 'true'
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ inputs.node_version }}
-      - name: Install dependencies
-        if: steps.front-node_modules.outputs.cache-hit != 'true'
-        run: cd src/frontend/ && yarn install --frozen-lockfile
-      - name: Cache install frontend
-        if: steps.front-node_modules.outputs.cache-hit != 'true'
-        uses: actions/cache@v5
-        with:
-          path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-
-  build-mails:
-    if: ${{ inputs.with-build_mails == true }}
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: src/mail
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Restore the mail templates
-        uses: actions/cache@v5
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-
-      - name: Setup Node.js
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ inputs.node_version }}
-
-      - name: Install yarn
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: npm install -g yarn
-
-      - name: Install node dependencies
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn install --frozen-lockfile
-
-      - name: Build mails
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn build
-
-      - name: Cache mail templates
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@v5
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}

.github/workflows/deploy.yml

@@ -1,35 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    tags:
-      - 'preprod'
-      - 'production'
-
-
-jobs:
-  notify-argocd:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Call argocd github webhook
-        run: |
-          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
-          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
-          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
-          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_PRODUCTION_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
-          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_PRODUCTION_WEBHOOK_URL
-
-  start-test-on-preprod:
-    needs:
-      - notify-argocd
-    runs-on: ubuntu-latest
-    if: startsWith(github.event.ref, 'refs/tags/preprod')
-    steps:
-      -
-        name: Debug
-        run: |
-          echo "Start test when preprod is ready"

.github/workflows/docker-hub.yml

@@ -1,5 +1,4 @@
 name: Docker Hub Workflow
-run-name: Docker Hub Workflow
 
 on:
   workflow_dispatch:
@@ -12,122 +11,34 @@ on:
     branches:
       - 'main'
 
-env:
-  DOCKER_USER: 1001:127
-
 jobs:
-  trivy-scan:
+  build-and-push:
     runs-on: ubuntu-latest
     steps:
       -
-        name: Checkout repository
-        uses: actions/checkout@v6
+        name: Checkout
+        uses: actions/checkout@v4
       -
         name: Docker meta
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: |
-            lasuite/people-backend
-            lasuite/people-frontend
+          images: lasuite/people
       -
-        name: Run trivy scan (backend)
-        uses: numerique-gouv/action-trivy-cache@main
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
         with:
-          docker-build-args: '--target backend-production -f Dockerfile'
-          docker-image-name: 'docker.io/lasuite/people-backend:${{ github.sha }}'
-      -
-        name: Run trivy scan (frontend)
-        uses: numerique-gouv/action-trivy-cache@main
-        with:
-          docker-build-args: '--target frontend-production -f src/frontend/Dockerfile'
-          docker-image-name: 'docker.io/lasuite/people-frontend:${{ github.sha }}'
-
-  build-and-push-backend:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: lasuite/people-backend
+          secret-file: .github/workflows/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      - name: create-version-json
-        id: create-version-json
-        uses: jsdaniell/create-json@v1.2.3
-        with:
-          name: "version.json"
-          json: '{"source":"${{github.repository}}", "version":"${{github.ref_name}}", "commit":"${{github.sha}}", "build": "NA"}'
-          dir: 'src/backend'
+        run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v5
         with:
           context: .
-          target: backend-production
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-frontend:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: lasuite/people-frontend
-      - name: create-version-json
-        id: create-version-json
-        uses: jsdaniell/create-json@v1.2.3
-        with:
-          name: "version.json"
-          json: '{"source":"${{github.repository}}", "version":"${{github.ref_name}}", "commit":"${{github.sha}}", "build": "NA"}'
-          dir: 'src/frontend/apps/desk'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./src/frontend/Dockerfile
-          target: frontend-production
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  notify-argocd:
-    needs:
-      - build-and-push-frontend
-      - build-and-push-backend
-    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request'
-    steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@main
-        id: notify
-        with:
-          deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"
-          argocd_webhook_secret: "${{ secrets.ARGOCD_PREPROD_WEBHOOK_SECRET }}"
-          argocd_url: "${{ vars.ARGOCD_PREPROD_WEBHOOK_URL }}"

.github/workflows/people.yml

@@ -4,42 +4,32 @@ on:
   push:
     branches:
       - main
+    tags:
+      - 'v*'
   pull_request:
     branches:
       - '*'
 
 jobs:
-  # Call the reusable workflow to install dependencies
-  dependencies:
-    uses: ./.github/workflows/dependencies.yml
-    with:
-      node_version: '22.x'
-      with-front-dependencies-installation: true
-      with-build_mails: true
-
   lint-git:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request' # Makes sense only for pull requests
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v2
         with:
-          fetch-depth: 0
+            fetch-depth: 0
       - name: show
         run: git log
       - name: Enforce absence of print statements in code
-        if: always()
         run: |
-          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude)**/people.yml' | grep -E "(\bprint\(|\bpprint\()"
+          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude)**/people.yml' | grep "print("
       - name: Check absence of fixup commits
-        if: always()
         run: |
           ! git log | grep 'fixup!'
       - name: Install gitlint
-        if: always()
         run: pip install --user requests gitlint
       - name: Lint commit messages added to main
-        if: always()
         run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
 
   check-changelog:
@@ -49,17 +39,17 @@ jobs:
       github.event_name == 'pull_request'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v2
         with:
-          fetch-depth: 0
+            fetch-depth: 0
       - name: Check that the CHANGELOG has been modified in the current branch
-        run: git log --name-only --pretty="" origin/${{ github.event.pull_request.base.ref }}..HEAD | grep CHANGELOG
+        run: git whatchanged --name-only --pretty="" origin/${{ github.event.pull_request.base.ref }}..HEAD | grep CHANGELOG
 
   lint-changelog:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v2
       - name: Check CHANGELOG max line length
         run: |
           max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -68,150 +58,121 @@ jobs:
             exit 1
           fi
 
-  build-front:
-    runs-on: ubuntu-latest
-    needs: dependencies
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        id: front-node_modules
-        with:
-          path: 'src/frontend/**/node_modules'
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-
-      - name: Build CI App
-        run: cd src/frontend/ && yarn ci:build
-
-      - name: Cache build frontend
-        uses: actions/cache@v5
-        with:
-          path: src/frontend/apps/desk/out/
-          key: build-front-${{ github.run_id }}
-
   test-front:
     runs-on: ubuntu-latest
-    needs: dependencies
+    defaults:
+      run:
+        working-directory: src/frontend/
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        id: front-node_modules
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          path: 'src/frontend/**/node_modules'
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+          node-version: '18.x'
+          cache: 'yarn'
+          cache-dependency-path: src/frontend/yarn.lock
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
 
       - name: Test App
-        run: cd src/frontend/ && yarn app:test
+        run: yarn app:test
+
+      - name: Test Translations
+        run: yarn i18n:test
 
   lint-front:
     runs-on: ubuntu-latest
-    needs: dependencies
+    defaults:
+      run:
+        working-directory: src/frontend/
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        id: front-node_modules
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          path: 'src/frontend/**/node_modules'
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+          node-version: '18.x'
+          cache: 'yarn'
+          cache-dependency-path: src/frontend/yarn.lock
 
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+        
       - name: Check linting
-        run: cd src/frontend/ && yarn lint
+        run: yarn lint
 
   test-e2e:
     runs-on: ubuntu-latest
-    needs: [dependencies, build-front]
     timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        shardIndex: [1, 2, 3, 4]
-        shardTotal: [4]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
-
+        uses: actions/checkout@v4
+            
       - name: Set services env variables
         run: |
           make create-env-files
           cat env.d/development/common.e2e.dist >> env.d/development/common
 
-      - name: Restore the mail templates
-        uses: actions/cache@v5
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-          fail-on-cache-miss: true  
-
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        id: front-node_modules
-        with:
-          path: 'src/frontend/**/node_modules'
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-
-      - name: Restore the build cache
-        uses: actions/cache@v5
-        id: cache-build
-        with:
-          path: src/frontend/apps/desk/out/
-          key: build-front-${{ github.run_id }}
-
       - name: Build and Start Docker Servers
         env:
           DOCKER_BUILDKIT: 1
           COMPOSE_DOCKER_CLI_BUILD: 1
         run: |
-          docker compose build --pull --build-arg BUILDKIT_INLINE_CACHE=1
-          make update-keycloak-realm-app
-          make add-dev-rsa-private-key-to-env
+          docker-compose build --pull --build-arg BUILDKIT_INLINE_CACHE=1
           make run
-
+        
       - name: Apply DRF migrations
         run: |
           make migrate
 
-      - name: Add dummy data
-        run: |
-          make demo FLUSH_ARGS='--no-input'
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18.x'
+          cache: 'yarn'
+          cache-dependency-path: src/frontend/yarn.lock
+
+      - name: Install dependencies
+        run: cd src/frontend/ && yarn install --frozen-lockfile
+
+      - name: Install Playwright Browsers
+        run: cd src/frontend/apps/e2e && yarn install
+
+      - name: Build CI App
+        run: cd src/frontend/ && yarn ci:build
 
       - name: Run e2e tests
-        run: cd src/frontend/ && yarn e2e:test --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
+        run: cd src/frontend/ && yarn e2e:test
 
-      - name: Save logs
-        if: always()
-        run: docker compose logs > src/frontend/apps/e2e/report/logs.txt
-
-      - name: Save Dimail logs
-        if: always()
-        run: docker compose logs dimail > src/frontend/apps/e2e/report/dimail-logs.txt
-
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v3
         if: always()
         with:
-          name: playwright-report-${{ matrix.shardIndex }}
+          name: playwright-report
           path: src/frontend/apps/e2e/report/
           retention-days: 7
 
-  tests-e2e-feedback:
+  build-mails:
     runs-on: ubuntu-latest
-    needs: [test-e2e]
-    if: always()
+    defaults:
+      run:
+        working-directory: src/mail
     steps:
-      - name: All tests ok
-        if: ${{ !(contains(needs.*.result, 'failure')) }}
-        run: exit 0
-      - name: Some tests failed
-        if: ${{ contains(needs.*.result, 'failure') }}
-        run: exit 1
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+      - name: Install yarn
+        run: npm install -g yarn
+      - name: Install node dependencies
+        run: yarn install --frozen-lockfile
+      - name: Build mails
+        run: yarn build
 
   lint-back:
     runs-on: ubuntu-latest
@@ -220,26 +181,22 @@ jobs:
         working-directory: src/backend
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/checkout@v2
+      - name: Install Python
+        uses: actions/setup-python@v3
         with:
-          python-version-file: "src/backend/pyproject.toml"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-      - name: Install the project
-        run: uv sync --locked --all-extras
-
+          python-version: '3.10'
+      - name: Install development dependencies
+        run: pip install --user .[dev]
       - name: Check code formatting with ruff
-        run: uv run ruff format . --diff
+        run: ~/.local/bin/ruff format . --diff
       - name: Lint code with ruff
-        run: uv run ruff check .
+        run: ~/.local/bin/ruff check .
       - name: Lint code with pylint
-        run: uv run pylint .
+        run: ~/.local/bin/pylint .
 
   test-back:
     runs-on: ubuntu-latest
-    needs: dependencies
     defaults:
       run:
         working-directory: src/backend
@@ -269,35 +226,86 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v2
       - name: Create writable /data
         run: |
           sudo mkdir -p /data/media && \
           sudo mkdir -p /data/static
-      - name: Restore the mail templates
-        uses: actions/cache@v5
-        id: mail-templates
+      - name: Install Python
+        uses: actions/setup-python@v3
         with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-          fail-on-cache-miss: true  
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version-file: "src/backend/pyproject.toml"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-      - name: Install the dependencies
-        run: uv sync --locked --all-extras
-
+          python-version: '3.10'
+      - name: Install development dependencies
+        run: pip install --user .[dev]
       - name: Install gettext (required to compile messages)
         run: |
           sudo apt-get update
           sudo apt-get install -y gettext
-
       - name: Generate a MO file from strings extracted from the project
-        run: uv run python manage.py compilemessages
-
+        run: python manage.py compilemessages
       - name: Run tests
-        run: uv run pytest -n 2
+        run: ~/.local/bin/pytest -n 2
+
+  i18n-crowdin:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+        
+      - name: Install gettext (required to make messages)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gettext
+      
+      - name: Install Python
+        uses: actions/setup-python@v3
+        with:
+          python-version: '3.10'
+
+      - name: Install development dependencies
+        working-directory: src/backend
+        run: pip install --user .[dev]
+
+      - name: Generate the translation base file
+        run: ~/.local/bin/django-admin makemessages --keep-pot --all
+        
+      - name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: .github/workflows/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18.x'
+          cache: 'yarn'
+          cache-dependency-path: src/frontend/yarn.lock
+
+      - name: Install dependencies
+        run: cd src/frontend/ && yarn install --frozen-lockfile
+
+      - name: Download sources from Crowdin to stay synchronized
+        run: |
+          docker run \
+          --rm \
+          -e CROWDIN_API_TOKEN=$CROWDIN_API_TOKEN \
+          -e CROWDIN_PROJECT_ID=$CROWDIN_PROJECT_ID \
+          -e CROWDIN_BASE_PATH=$CROWDIN_BASE_PATH \
+          -v "${{ github.workspace }}:/app" \
+          crowdin/cli:3.16.0 \
+          crowdin download sources -c /app/crowdin/config.yml
+      
+      - name: Extract the frontend translation
+        run: make frontend-i18n-extract
+      
+      - name: Upload files to Crowdin
+        run: |
+          docker run \
+          --rm \
+          -e CROWDIN_API_TOKEN=$CROWDIN_API_TOKEN \
+          -e CROWDIN_PROJECT_ID=$CROWDIN_PROJECT_ID \
+          -e CROWDIN_BASE_PATH=$CROWDIN_BASE_PATH \
+          -v "${{ github.workspace }}:/app" \
+          crowdin/cli:3.16.0 \
+          crowdin upload sources -c /app/crowdin/config.yml

.github/workflows/release-helmchart.yml

@@ -1,36 +0,0 @@
-name: Release Chart
-run-name: Release Chart
-
-on:
-  push:
-    branches:
-      - 'main'
-
-jobs:
-  release:
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Cleanup
-        run: |
-          rm -rf ./src/helm/extra
-          rm -rf ./src/helm/dimail
-          rm -rf ./src/helm/maildev
-
-      - name: Install Helm
-        uses: azure/setup-helm@v4
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Publish Helm charts
-        uses: numerique-gouv/helm-gh-pages@add-overwrite-option
-        with:
-          charts_dir: ./src/helm
-          linting: on
-          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/secrets.enc.env

@@ -0,0 +1,20 @@
+SOPS_PRIVATE=ENC[AES256_GCM,data:uMsnbpi1FFxO430iptp2axlH/souCPCJ/afCqh/kIDWs8xWHu0xJ2o6PlNOgb4l1gHF8sy4eSHFOW5HPKVbZ9gafRIL0JYHJr3A=,iv:IgaHDad7IuW2wFoxGALLDCs+UiSd3rEYwGNSX38wUfI=,tag:zs4wn4hDm5fghfI/7iH6CQ==,type:str]
+CROWDIN_API_TOKEN=ENC[AES256_GCM,data:tZRGFs792GjKYGit+oNubCwPbjWarhlgcyQ7oStO8K3nao0lEzLrm3+ARaOEXkzEkKSal2N1c+vlYIjRyzV1X7WZ7nZQWBiihEJgAfF3NGM=,iv:hohak/1niu5kV/W4XA0KEE3UB0BuNCDxbRxb0O+Aocs=,tag:Ssi0HyEhCKb9+WFyp3/yBQ==,type:str]
+CROWDIN_BASE_PATH=ENC[AES256_GCM,data:m44KrW5xJDE=,iv:bSyKrKQ0Z1yzrNaejAUyD+n1Z9z+ci92GoyS5KiiFKI=,tag:dDtpbn+6LkPwsg+qgMNWvA==,type:str]
+CROWDIN_PROJECT_ID=ENC[AES256_GCM,data:Gonh6ps7,iv:yUqPty+R060m6CYrDf7na2f6h0aRpIhRCXZoJW4ThJg=,tag:ewupoenajsc9o0Aj0r/niw==,type:str]
+DOCKER_HUB_PASSWORD=ENC[AES256_GCM,data:CBjUvS/UQcqdEv8=,iv:zJKGyyRnq+zxhKkYS5h3zw/J1320zrAqpiObcwiHWsA=,tag:OoQNe+4K63KXTWNsvjRZNQ==,type:str]
+DOCKER_HUB_USER=ENC[AES256_GCM,data:ivs7oeBBdA==,iv:cKAQJ071XhcRuFyeHhZkscvvz7sHrKIPJg5pt76hCXg=,tag:2VRmp1ULWvVH8NHcBifBGA==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbkIyRi9jTGEzL2RZcGFS\nVkhuN2xMN1FBcm04eGJQUnpvQVRpdmFmaFF3CjdoNVhSM0lrb0lTSXAyUytSKzhG\nNERYaC80OThmUUxCSmt2U2Q0Mno3b0kKLS0tIFRjQzYyOEcwTnRScGhzaGxwaGFL\namxEUXNaeVhWUjYwbzR2Z1Uzb3JsTlEK6tyhbRmcUP4Aql49DPkrYb5tbwvK2EdA\ntvyPQo4pPit+pzgqsVgW+O8Wo4/rYLlITfuVRrOfHEaH3wmf6hziSw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIL2NwVjVtVmd1ZE15WmFC\nVGl5cnU1OHVUcXAxWmZCQXBJbXBlcXFUN0RzClpOVXBTek9wbVB6M2s5TWlFbUo3\nelZrT3dsK3p6cEJGTGJoSTRvaEh4NW8KLS0tIGlsL29oSEthU28xV0RERFIxTnZR\nSSs3YjdUT0NyTEtlbjlmZXVOaTd3SzgK5jFJGREfJ/HVytWsCKWFsqM5JoaFSnhv\n538KzzldzcbtWfnY+bQ6A2EBjETwOzCTuQB8axAMj0URXPI+qelKIQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzOWtwSytMNGRmSHNQN0Zz\nV1RTWktXT1c5VjYvNTg2V0x1U3JSTFA1dmtvCnc4RHRodjVxSzcrZXJycCtJMGNy\nZ3ZwbTFDTUc4TTMxbm8rNXQ1ME90Q1UKLS0tIERPUmg1dSt5OWQwaXV0Y2FiYWdt\nVzlhcFNvUS9Nd3A5ZTYwT2lLUU5WVU0KGHSm1BQ3voKs98WiXNLO6hlqoiQmi1/F\n2RCBkE4/gOVyAmJAjOFizaF0Dhd7Ba4KS5l5QylFHloL8XtyixEhog==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_recipient=age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv
+sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmYlB6cEZKK3NLbm5Ob0hi\nS3M0OFoyTHhVYVA1WmcvSHc2MUErQ2JyaUh3Cnp1NlYvU1BPUnVON29UZWUvWmEz\nOW85N013VUJ3Q1ZZUmMvTWdYclBZTUkKLS0tIG1KODdkazhTUHRPMXZXQnJFNXJY\nOFlSNjZCbkpxcm9tN1dFTkZ4K1lETFUKhiPwKEG71OlTcK/Ul1GKGayLy025vAmo\nNgQUhbqXf7KmqDAmrQNzXTsLsOpRi33l66jFSGkTsFtiXNlmjFljKg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_3__map_recipient=age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3
+sops_age__list_4__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJUzI2eDB0MU41YWoxcjAv\nOU8yMlowb3IybCtzcFBBTEVlUzdBczZkQlFNCk5tbnhLR2kweGNFZmx1OFgwaWZU\nTzRKZTBZamJjRFNYOUJlYmxTUVg4S2MKLS0tIDNGdlVVc0hLK1BPTUJVc0tPb1lK\ndVVWVi9GRkxwYXR1cXMrdnlsejJBeGsKKmVWvIMrBYH+UrDMkZPxN8KWnCgA6WK2\nbexMYr2AIF2QMbhck7XW2NuvAwvwjbJMfcd+cp9boe+EcC4YjdJZlw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_4__map_recipient=age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa
+sops_lastmodified=2024-02-05T17:45:08Z
+sops_mac=ENC[AES256_GCM,data:WMsYYvGId0UlRhiw5C4TTpP/7oIIgWteGRtX7Nlo3qQwBc1LSUyN+7kblkXWD+nNG51B0xfl9E5QdXO3Ao2WskQZZEJqqkmt6wSw/ScSPcH56FoIqBhoGsPKyJOZkK0zojnCJQLniTDlISG0UiiJ4KHh8FJDWYbzAy2zFEm3Et8=,iv:zB2hyxnKiA3flsMQ7XFOT/fR9hamd6YWo3BNwce4oWM=,tag:uZ2Ia8sR5R8fmURtJ+PojA==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.8.1

.gitignore

@@ -42,6 +42,7 @@ env.bak/
 venv.bak/
 env.d/development/*
 !env.d/development/*.dist
+env.d/terraform
 
 # npm
 node_modules
@@ -58,12 +59,13 @@ src/frontend/tsclient
 # Logs
 *.log
 
-# Celery beat
-src/backend/celerybeat-schedule
+# Terraform
+.terraform
+*.tfstate
+*.tfstate.backup
 
 # Test & lint
 .coverage
-coverage.json
 .pylint.d
 .pytest_cache
 db.sqlite3
@@ -77,4 +79,3 @@ db.sqlite3
 .vscode/
 *.iml
 .devcontainer/
-.tool-versions

.sops.yaml

@@ -0,0 +1,13 @@
+creation_rules:
+  # Here we have
+  # - Jacques key-id: age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
+  # - github-repo key-id: age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7
+  # - Anthony Le-Courric key-id: age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv
+  # - Antoine Lebaud key-id: age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3
+  # - Marie Pupo Jeammet key-id: age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa
+  - age:
+      age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x,
+      age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7,
+      age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv,
+      age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3,
+      age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa

CHANGELOG.md

@@ -7,566 +7,3 @@ and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
-
-## [1.24.0] - 2026-03-24
-
-### Fixed
-
-- ✨(mailboxes) enforce lowercase on mailboxes
-- 🐛(i18n) fix missing translations for status tag labels
-- 🚚(route) prioritize mail domains as default landing page
-
-### Changed
-
-- 💄(config) update ui configuration domain modale
-- 🍱(static) update logo in invitation email template #1085
-- ✨(uiV2) use Lasuite UI kit, new layout
-
-## [1.23.1] - 2026-02-16
-
-- ✨(invitations) refresh expired invitations
-
-## [1.23.0] - 2026-02-12
-
-### Added
-
-- ✨(demo) add aliases to demo #1050
-- ✨(front) add icon to button to configure a domain
-- ✨(datagrid) add sort to mailboxes list + mail domain list
-- ✨(invitations) allow delete invitations mails domains access by an admin
-- ✨(front) delete invitations mails domains access
-- ✨(front) add show invitations mails domains access #1040
-- ✨(invitations) can delete domain invitations
-
-### Fixed
-
-- 🐛(domains) fix attemps to send invitations to existing users #953
-
-### Changed
-
-- 🚸(email) we should ignore case when looking for existing emails #1056
-- 🏗️(core) migrate from pip to uv
-- ✨(front) add show invitations mails domains access #1040
-
-## [1.22.2] - 2026-01-26
-
-### Fixed
-
-- 🐛(aliases) authorize special domain devnull in alias destinations #1029 
-
-## [1.22.1] - 2026-01-21
-
-- 🔒️(organization) the first user is not admin #776
-- 🐛(admin) fix broken alias import #1021
-
-## [1.22.0] - 2026-01-19
-
-### Added
-- ✨(front) create, manage & delete aliases
-- ✨(domains) alias sorting and admin
-- ✨(aliases) delete all aliases in one call #1002
-
-### Fixed
-- 🔒️(security) upgrade python version to fix vulnerability #1010
-- 🐛(dimail) ignore oxadmin when importing mailboxes from dimail #986
-- ✨(aliases) fix deleting single aliases #1002
-
-### Changed
-- 🐛(dimail) allow mailboxes and aliases to have the same local part #986
-
-### Removed
-- 🔥(plugins) remove CommuneCreation plugin
-
-## [1.21.0] - 2025-12-05
-
-- ✨(aliases) import existing aliases from dimail
-- 🛂(permissions) return 404 to users with no access to domain #985 
-- ✨(aliases) can create, list and delete aliases #974
-
-## [1.20.0] - 2025-10-22
-
-- ✨(models) impose uniqueness on display name, to match ox's constraint
-- 🐛(dimail) catch duplicate displayname error
-- ✨(mailbox) synchronize password of newly created mailbox with Dimail's
-
-## [1.19.1] - 2025-09-19
-
-- 🐛(fix) add enabled update your mailbox
-
-## [1.19.0] - 2025-09-03
-
-- ✨(front) add modal update mailboxes #954
-
-### Added
-
-- ✨(api) update mailboxes #934
-- ✨(api) give update rights to domain viewer on own mailbox #934
-
-### Fixed
-
-- 🐛(dimail) grab duplicate displayname error #961
-
-### Changed
-
-- 💥(sentry) remove `DJANGO_` before Sentry DSN env variable #957
-
-## [1.18.2] - 2025-07-03
-
-### Fixed
-
-- 🐛(front) fix missing pagination mail domains #950
-
-## [1.18.1] - 2025-07-02
-
-### Fixed
-
-- 🐛(front) fix missing pagination on mail domains #946
-
-## [1.18.0] - 2025-06-30
-
-### Added
-
-- 🐛(front) fix missing pagination mail domains
-- 🐛(front) fix button add mail domain
-- ✨(teams) add matrix webhook for teams #904
-- ✨(resource-server) add SCIM /Me endpoint #895
-- 🔧(git) set LF line endings for all text files #928
-
-### Changed
-
-- 🧑‍💻(docker) split frontend to another file #924
-
-### Fixed 
-
-- 🐛(webhook) handle user on different home server than room server
-
-## [1.17.0] - 2025-06-11
-
-### Added
-
-- ✨(frontend) add crisp script #914
-- ⚡️(fix) add error when mailbox create failed
-- ✨(mailbox) allow to reset password on mailboxes #834
-
-## [1.16.0] - 2025-05-05
-
-### Added
-
-- 🔧(sentry) add Celery beat task integration #892
-
-### Changed
-
-- ✨(uiv2) change mail domains
-- 🛂(dimail) simplify interop with dimail
-- ✨(mailbox) remove secondary email as required field
-
-### Fixed
-
-- 🔒️(drf) disable browsable HTML API renderer #897
-
-## [1.15.0] - 2025-04-04
-
-### Added
-
-- 🧱(helm) add la-suite ingress path
-- ➕(backend) add django-lasuite dependency #858
-- ✨(plugins) add endpoint to list siret of active organizations #771
-- ✨(core) create AccountServiceAuthentication backend #771
-- ✨(core) create AccountService model #771
-- 🧱(helm) disable createsuperuser job by setting #863
-- 🔒️(passwords) add validators for production #850
-- ✨(domains) allow to re-run check on domain if status is failed
-- ✨(organization) add `is_active` field
-- ✨(domains) notify support when domain status changes #668
-- ✨(domains) define domain check interval as a settings
-- ✨(oidc) add simple introspection backend #832
-- 🧑‍💻(tasks) run management commands #814
-
-### Changed
-
-- ♻️(plugins) rewrite plugin system as django app #844
-- 🔒️(users) restrict listable users to same organization #846 
-
-### Fixed
-
-- 🐛(dimail) enhance sentry log
-- 🐛(oauth2) force JWT signed for /userinfo #804
-- 🐛(front) disable retries in useQuery and useInfiniteQuery #818
-
-## [1.14.1] - 2025-03-17
-
-## [1.14.0] - 2025-03-17
-
-### Added
-
-- ✨(domains) enhance required action modal content
-- ✨(domains) add periodic tasks to fetch domain status
-- 🧑‍💻(docker) add celery beat to manage periodic tasks
-- ✨(organization) add metadata field #790
-- ⬆️(nginx) bump nginx-unprivileged to 1.27 #797
-- ✨(teams) allow broadly available teams #796
-- ✨(teams) update and enhance team invitation email
-- ✨(api) define dimail timeout as a setting
-- ✨(frontend) feature modal add new access role to domain 
-- ✨(api) allow invitations for domain management #708
-
-### Fixed
-
-- 🐛(oauth2) force JWT signed for /userinfo #804
-- 🐛(oauth2) add ProConnect scopes #802
-- 🐛(domains) use a dedicated mail to invite user to manage domain
-- 🐛(mailbox) fix mailbox creation email language
-
-## [1.13.1] - 2025-03-04
-
-### Fixed
-
-- 🐛(mailbox) fix migration to fill dn_email field
-
-## [1.13.0] - 2025-03-04
-
-### Added
-
-- ✨(oidc) people as an identity provider #638
-
-### Fixed
-
-- 💄(domains) improve user experience and avoid repeat fix_domain operations
-- 👽️(dimail) increase timeout value for check domain API call
-- 🧱(helm) add resource-server ingress path #743
-- 🌐(backend) synchronize translations with crowdin again
-
-## [1.12.1] - 2025-02-20
-
-### Fixed
-
-- 👽️(dimail) increase timeout value for API calls
-
-## [1.12.0] - 2025-02-18
-
-### Added
-
-- ✨(domains) allow user to re-run all fetch domain data from dimail
-- ✨(domains) display DNS config expected for domain with required actions
-- ✨(domains) check status after creation
-- ✨(domains) display required actions to do on domain
-- ✨(plugin) add CommuneCreation plugin with domain provisioning #658
-- ✨(frontend) display action required status on domain
-- ✨(domains) store last health check details on MailDomain
-- ✨(domains) add support email field on domain
-
-## [1.11.0] - 2025-02-07
-
-### Added
-
-- ✨(api) add count mailboxes to MailDomain serializer
-- ✨(dimail) manage 'action required' status for MailDomain
-- ✨(domains) add action required status on MailDomain
-- ✨(dimail) send pending mailboxes upon domain activation
-
-### Fixed
-
-- ✨(auth) fix empty names from ProConnect #687
-- 🚑️(teams) do not display add button when disallowed #676
-- 🚑️(plugins) fix name from SIRET specific case #674
-- 🐛(api) restrict mailbox sync to enabled domains
-
-## [1.10.1] - 2025-01-27
-
-### Added
-
-- ✨(dimail) management command to fetch domain status
-
-### Changed
-
-- ✨(scripts) adapts release script after moving the deployment part
-
-### Fixed
-
-- 🐛(dimail) fix imported mailboxes should be enabled instead of pending #659 
-- ⚡️(api) add missing cache for stats endpoint
-
-## [1.10.0] - 2025-01-21
-
-### Added
-
-- ✨(api) create stats endpoint
-- ✨(teams) add Team dependencies #560
-- ✨(organization) add admin action for plugin #640
-- ✨(anct) fetch and display organization names of communes #583
-- ✨(frontend) display email if no username #562
-- 🧑‍💻(oidc) add ability to pull registration ID (e.g. SIRET) from OIDC #577
-
-### Fixed
-
-- 🐛(frontend) improve e2e tests avoiding race condition from mocks #641
-- 🐛(backend) fix flaky test with search contact #605
-- 🐛(backend) fix flaky test with team access #646
-- 🧑‍💻(dimail) remove 'NoneType: None' log in debug mode
-- 🐛(frontend) fix flaky e2e test #636
-- 🐛(frontend) fix disable mailbox button display #631
-- 🐛(backend) fix dimail call despite mailbox creation failure on our side
-- 🧑‍💻(user) fix the User.language infinite migration #611
-
-## [1.9.1] - 2024-12-18
-
-## [1.9.0] - 2024-12-17
-
-### Fixed
-
-- 🐛(backend) fix manage roles on domain admin view
-
-### Added
-
-- ✨(backend) add admin action to check domain health
-- ✨(dimail) check domain health
-- ✨(frontend) disable mailbox and allow to create pending mailbox
-- ✨(organizations) add siret to name conversion #584
-- 💄(frontend) redirect home according to abilities #588
-- ✨(maildomain_access) add API endpoint to search users #508
-
-## [1.8.0] - 2024-12-12
-
-### Added
-
-- ✨(contacts) add "abilities" to API endpoint data #585
-- ✨(contacts) allow filter list API with email
-- ✨(contacts) return profile contact from same organization
-- ✨(dimail) automate allows requests to dimail
-- ✨(contacts) add notes & force full_name #565
-
-### Changed
-
-- ♻️(contacts) move user profile to contact #572
-- ♻️(contacts) split api test module in actions #573
-
-### Fixed
-
-- 🐛(backend) fix manage roles on domain admin view
-- 🐛(mailbox) fix activate mailbox feature
-- 🔧(helm) fix the configuration environment #579
-
-## [1.7.1] - 2024-11-28
-
-## [1.7.0] - 2024-11-28
-
-### Added
-
-- ✨(mailbox) allow to activate mailbox
-- ✨(mailbox) allow to disable mailbox
-- ✨(backend) add ServiceProvider #522
-- 💄(admin) allow header color customization #552 
-- ✨(organization) add API endpoints #551
-
-### Fixed
-
--  🐛(admin) add organization on user #555
-
-## [1.6.1] - 2024-11-22
-
-### Fixed
-
-- 🩹(mailbox) fix status of current mailboxes
-- 🚑️(backend) fix claim contains non-user field #548
-
-## [1.6.0] - 2024-11-20
-
-### Removed
-
-- 🔥(teams) remove search by trigram for team access and contact
-
-### Added
-
-- ✨(domains) allow creation of "pending" mailboxes
-- ✨(teams) allow team management for team admins/owners #509
-
-### Fixed
-
--  🔊(backend) update logger config to info #542
-
-## [1.5.0] - 2024-11-14
-
-### Removed
-
-- ⬆️(dependencies) remove unneeded dependencies
-- 🔥(teams) remove pagination of teams listing
-- 🔥(teams) remove search users by trigram
-- 🗃️(teams) remove `slug` field
-
-### Added
-
-- ✨(dimail) send domain creation requests to dimail #454
-- ✨(dimail) synchronize mailboxes from dimail to our db #453
-- ✨(ci) add security scan #429
-- ✨(teams) register contacts on admin views
-
-### Fixed
-
-- 🐛(mail) fix display button on outlook
-- 💚(ci) improve E2E tests #492
-- 🔧(sentry) restore default integrations
-- 🔇(backend) remove Sentry duplicated warning/errors
-- 👷(ci) add sharding e2e tests  #467
-- 🐛(dimail) fix unexpected status_code for proper debug #454
-
-## [1.4.1] - 2024-10-23
-
-### Fixed
-
-- 🚑️(frontend) fix MailDomainsLayout
-
-## [1.4.0] - 2024-10-23
-
-### Added
-
-- ✨(frontend) add tabs inside #466
-
-### Fixed
-
-- ✏️(mail) fix typo into mailbox creation email
-- 🐛(sentry) fix duplicated sentry errors #479
-- 🐛(script) improve and fix release script
-
-## [1.3.1] - 2024-10-18
-
-## [1.3.0] - 2024-10-18
-
-### Added
-
-- ✨(api) add RELEASE version on config endpoint #459
-- ✨(backend) manage roles on domain admin view
-- ✨(frontend) show version number in footer #369
-- 👔(backend) add Organization model
-
-### Changed
-
-- 🛂(backend) match email if no existing user matches the sub
-
-### Fixed
-
-- 💄(mail) improve mailbox creation email #462
-- 🐛(frontend) fix update accesses form #448
-- 🛂(backend) do not duplicate user when disabled
-
-## [1.2.1] - 2024-10-03
-
-### Fixed
-
-- 🔧(mail) use new scaleway email gateway #435 
-
-
-## [1.2.0] - 2024-09-30
-
-
-### Added
-
-- ✨(ci) add helmfile linter and fix argocd sync #424 
-- ✨(domains) add endpoint to list and retrieve domain accesses #404
-- 🍱(dev) embark dimail-api as container #366
-- ✨(dimail) allow la regie to request a token for another user #416
-- ✨(frontend) show username on AccountDropDown #412
-- 🥅(frontend) improve add & update group forms error handling #387
-- ✨(frontend) allow group members filtering #363
-- ✨(mailbox) send new mailbox confirmation email #397
-- ✨(domains) domain accesses update API #423
-- ✨(backend) domain accesses create API #428
-- 🥅(frontend) catch new errors on mailbox creation #392
-- ✨(api) domain accesses delete API #433
-- ✨(frontend) add mail domain access management #413
-
-### Fixed
-
-- ♿️(frontend) fix left nav panel #396
-- 🔧(backend) fix configuration to avoid different ssl warning #432 
-
-### Changed
-
-- ♻️(serializers) move business logic to serializers #414 
-
-## [1.1.0] - 2024-09-10
-
-### Added
-
-- 📈(monitoring) configure sentry monitoring #378
-- 🥅(frontend) improve api error handling #355
-
-### Changed
-
-- 🗃️(models) move dimail 'secret' to settings #372 
-
-### Fixed
-
-- 🐛(dimail) improve handling of dimail errors on failed mailbox creation #377
-- 💬(frontend) fix group member removal text #382
-- 💬(frontend) fix add mail domain text #382
-- 🐛(frontend) fix keyboard navigation #379
-- 🐛(frontend) fix add mail domain form submission #355
-
-## [1.0.2] - 2024-08-30
-
-### Added
-
-- 🔧Runtime config for the frontend (#345)
-- 🔧(helm) configure resource server in staging
-
-### Fixed 
-
-- 👽️(mailboxes) fix mailbox creation after dimail api improvement (#360)
-
-## [1.0.1] - 2024-08-19
-
-### Fixed
-
-- ✨(frontend) user can add mail domains
-
-## [1.0.0] - 2024-08-09
-
-### Added
-
-- ✨(domains) create and manage domains on admin + API
-- ✨(domains) mailbox creation + link to email provisioning API
-
-[unreleased]: https://github.com/suitenumerique/people/compare/v1.24.0...main
-[1.24.0]: https://github.com/suitenumerique/people/releases/v1.24.0
-[1.23.1]: https://github.com/suitenumerique/people/releases/v1.23.1
-[1.23.0]: https://github.com/suitenumerique/people/releases/v1.23.0
-[1.22.2]: https://github.com/suitenumerique/people/releases/v1.22.2
-[1.22.1]: https://github.com/suitenumerique/people/releases/v1.22.1
-[1.22.0]: https://github.com/suitenumerique/people/releases/v1.22.0
-[1.21.0]: https://github.com/suitenumerique/people/releases/v1.21.0
-[1.20.0]: https://github.com/suitenumerique/people/releases/v1.20.0
-[1.19.1]: https://github.com/suitenumerique/people/releases/v1.19.1
-[1.19.0]: https://github.com/suitenumerique/people/releases/v1.19.0
-[1.18.2]: https://github.com/suitenumerique/people/releases/v1.18.2
-[1.18.1]: https://github.com/suitenumerique/people/releases/v1.18.1
-[1.18.0]: https://github.com/suitenumerique/people/releases/v1.18.0
-[1.17.0]: https://github.com/suitenumerique/people/releases/v1.17.0
-[1.16.0]: https://github.com/suitenumerique/people/releases/v1.16.0
-[1.15.0]: https://github.com/suitenumerique/people/releases/v1.15.0
-[1.14.1]: https://github.com/suitenumerique/people/releases/v1.14.1
-[1.14.0]: https://github.com/suitenumerique/people/releases/v1.14.0
-[1.13.1]: https://github.com/suitenumerique/people/releases/v1.13.1
-[1.13.0]: https://github.com/suitenumerique/people/releases/v1.13.0
-[1.12.1]: https://github.com/suitenumerique/people/releases/v1.12.1
-[1.12.0]: https://github.com/suitenumerique/people/releases/v1.12.0
-[1.11.0]: https://github.com/suitenumerique/people/releases/v1.11.0
-[1.10.1]: https://github.com/suitenumerique/people/releases/v1.10.1
-[1.10.0]: https://github.com/suitenumerique/people/releases/v1.10.0
-[1.9.1]: https://github.com/suitenumerique/people/releases/v1.9.1
-[1.9.0]: https://github.com/suitenumerique/people/releases/v1.9.0
-[1.8.0]: https://github.com/suitenumerique/people/releases/v1.8.0
-[1.7.1]: https://github.com/suitenumerique/people/releases/v1.7.1
-[1.7.0]: https://github.com/suitenumerique/people/releases/v1.7.0
-[1.6.1]: https://github.com/suitenumerique/people/releases/v1.6.1
-[1.6.0]: https://github.com/suitenumerique/people/releases/v1.6.0
-[1.5.0]: https://github.com/suitenumerique/people/releases/v1.5.0
-[1.4.1]: https://github.com/suitenumerique/people/releases/v1.4.1
-[1.4.0]: https://github.com/suitenumerique/people/releases/v1.4.0
-[1.3.1]: https://github.com/suitenumerique/people/releases/v1.3.1
-[1.3.0]: https://github.com/suitenumerique/people/releases/v1.3.0
-[1.2.1]: https://github.com/suitenumerique/people/releases/v1.2.1
-[1.2.0]: https://github.com/suitenumerique/people/releases/v1.2.0
-[1.1.0]: https://github.com/suitenumerique/people/releases/v1.1.0
-[1.0.2]: https://github.com/suitenumerique/people/releases/v1.0.2
-[1.0.1]: https://github.com/suitenumerique/people/releases/v1.0.1
-[1.0.0]: https://github.com/suitenumerique/people/releases/v1.0.0

CONTRIBUTING.md

@@ -1,109 +0,0 @@
-# Contributing to the Project
-
-Thank you for taking the time to contribute! Please follow these guidelines to ensure a smooth and productive workflow. 🚀🚀🚀
-
-To get started with the project, please refer to the [README.md](https://github.com/suitenumerique/docs/blob/main/README.md) for detailed instructions.
-
-Please also check out our [dev handbook](https://suitenumerique.gitbook.io/handbook) to learn our best practices.
-
-## Help us with translations
-
-You can help us with translations on [Crowdin](https://crowdin.com/project/lasuite-people).
-Your language is not there? Request it on our Crowdin page 😊.
-
-## Creating an Issue
-
-When creating an issue, please provide the following details:
-
-1.  **Title**: A concise and descriptive title for the issue.
-2.  **Description**: A detailed explanation of the issue, including relevant context or screenshots if applicable.
-3.  **Steps to Reproduce**: If the issue is a bug, include the steps needed to reproduce the problem.
-4.  **Expected vs. Actual Behavior**: Describe what you expected to happen and what actually happened.
-5.  **Labels**: Add appropriate labels to categorize the issue (e.g., bug, feature request, documentation).
-
-## Selecting an issue
-
-We use a [GitHub Project](https://github.com/orgs/suitenumerique/projects/1) in order to prioritize our workload. 
-
-Please check in priority the issues that are in the **TODO cette semaine** column. 
-
-## Commit Message Format
-
-All commit messages must adhere to the following format:
-
-`<gitmoji>(type) title description`
-
-*   <**gitmoji**>: Use a gitmoji to represent the purpose of the commit. For example, ✨ for adding a new feature or 🔥 for removing something, see the list here: <https://gitmoji.dev/>.
-*   **(type)**: Describe the type of change. Common types include `backend`, `frontend`, `CI`, `docker` etc...
-*   **title**: A short, descriptive title for the change, starting with a lowercase character.
-*   **description**: Include additional details about what was changed and why.
-
-### Example Commit Message
-
-```
-✨(frontend) add user authentication logic 
-
-Implemented login and signup features, and integrated OAuth2 for social login.
-```
-
-## Changelog Update
-
-Please add a line to the changelog describing your development. The changelog entry should include a brief summary of the changes, this helps in tracking changes effectively and keeping everyone informed. We usually include the title of the pull request, followed by the pull request ID to finish the log entry. The changelog line should be less than 80 characters in total.
-
-### Example Changelog Message
-```
-## [Unreleased]
-
-## Added
-
-- ✨(frontend) add AI to the project #321
-```
-
-## Pull Requests
-
-It is nice to add information about the purpose of the pull request to help reviewers understand the context and intent of the changes. If you can, add some pictures or a small video to show the changes.
-
-### Don't forget to: 
-- check your commits
-- check the linting: `make lint && make frontend-lint`
-- check the tests: `make test`
-- add a changelog entry
-- squash your commits
-- rebase your branch on the latest `main` branch before pushing your changes `git pull --rebase origin main`
-
-### Process to have a nice commit history
-
-In the life time of your PR, you may need to add commits to fix things or add new features.
-Commit after commit, your PR will be full of commits but you have to clean it up with the following commands before merging on `main`:
-
-Gradually you can use `--fixup` to add commits to some of previous commit ( for example 1234567890).
-```
-git commit --fixup=1234567890
-```
-Then, you can squash your commits with the following command:
-```
-git rebase --autosquash -i -r  HEAD~<number-of-commits>
-```
-
-Or you can use:
-```
-git rebase -i HEAD~<number-of-commits>
-```
-and move, squash and/or rename your commits manually. You can squash them with previous commit replacing the `pick` by `f`. You can rename them with replacing the `pick` by `r`.
-Tada! You have a clean commit history.
-
-Once all the required tests have passed, you can request a review from the project maintainers.
-
-## Code Style
-
-Please maintain consistency in code style. Run any linting tools available to make sure the code is clean and follows the project's conventions.
-
-## Tests
-
-Make sure that all new features or fixes have corresponding tests. Run the test suite before pushing your changes to ensure that nothing is broken.
-
-## Asking for Help
-
-If you need any help while contributing, feel free to open a discussion or ask for guidance in the issue tracker. We are more than happy to assist!
-
-Thank you for your contributions! 👍

Dockerfile

@@ -1,39 +1,30 @@
 # Django People
 
 # ---- base image to inherit from ----
-FROM python:3.14.2-alpine AS base
+FROM python:3.10-slim-bullseye as base
+
+# Upgrade pip to its latest release to speed up dependencies installation
+RUN python -m pip install --upgrade pip
 
 # Upgrade system packages to install security updates
-RUN apk update && \
-  apk upgrade
+RUN apt-get update && \
+  apt-get -y upgrade && \
+  rm -rf /var/lib/apt/lists/*
 
 # ---- Back-end builder image ----
-FROM base AS back-builder
+FROM base as back-builder
 
-ENV UV_COMPILE_BYTECODE=1
-ENV UV_LINK_MODE=copy
+WORKDIR /builder
 
-# Disable Python downloads, because we want to use the system interpreter
-# across both images. If using a managed Python version, it needs to be
-# copied from the build image into the final image;
-ENV UV_PYTHON_DOWNLOADS=0
+# Copy required python dependencies
+COPY ./src/backend /builder
 
-# install uv
-COPY --from=ghcr.io/astral-sh/uv:0.9.10 /uv /uvx /bin/
-
-WORKDIR /app
-
-RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=bind,source=src/backend/uv.lock,target=uv.lock \
-    --mount=type=bind,source=src/backend/pyproject.toml,target=pyproject.toml \
-    uv sync --locked --no-install-project --no-dev
-COPY src/backend /app
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-dev
+RUN mkdir /install && \
+  pip install --prefix=/install .
 
 
 # ---- mails ----
-FROM node:22 AS mail-builder
+FROM node:18 as mail-builder
 
 COPY ./src/mail /mail/app
 
@@ -44,21 +35,24 @@ RUN yarn install --frozen-lockfile && \
 
 
 # ---- static link collector ----
-FROM base AS link-collector
+FROM base as link-collector
 ARG PEOPLE_STATIC_ROOT=/data/static
 
 # Install libpangocairo & rdfind
-RUN apk add \
-  pango \
-  rdfind
+RUN apt-get update && \
+    apt-get install -y \
+      libpangocairo-1.0-0 \
+      rdfind && \
+    rm -rf /var/lib/apt/lists/*
+
+# Copy installed python dependencies
+COPY --from=back-builder /install /usr/local
+
+# Copy people application (see .dockerignore)
+COPY ./src/backend /app/
 
 WORKDIR /app
 
-# Copy the application from the builder
-COPY --from=back-builder /app /app
-
-ENV PATH="/app/.venv/bin:$PATH"
-
 # collectstatic
 RUN DJANGO_CONFIGURATION=Build DJANGO_JWT_PRIVATE_SIGNING_KEY=Dummy \
     python manage.py collectstatic --noinput
@@ -68,18 +62,21 @@ RUN DJANGO_CONFIGURATION=Build DJANGO_JWT_PRIVATE_SIGNING_KEY=Dummy \
 RUN rdfind -makesymlinks true -followsymlinks true -makeresultsfile false ${PEOPLE_STATIC_ROOT}
 
 # ---- Core application image ----
-FROM base AS core
+FROM base as core
 
 ENV PYTHONUNBUFFERED=1
 
 # Install required system libs
-RUN apk add \
-  gettext \
-  cairo \
-  libffi-dev \
-  gdk-pixbuf \
-  pango \
-  shared-mime-info
+RUN apt-get update && \
+    apt-get install -y \
+      gettext \
+      libcairo2 \
+      libffi-dev \
+      libgdk-pixbuf2.0-0 \
+      libpango-1.0-0 \
+      libpangocairo-1.0-0 \
+      shared-mime-info && \
+  rm -rf /var/lib/apt/lists/*
 
 # Copy entrypoint
 COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
@@ -89,35 +86,34 @@ COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
 # docker user (see entrypoint).
 RUN chmod g=u /etc/passwd
 
-# Copy the application from the builder
-COPY --from=back-builder /app /app
+# Copy installed python dependencies
+COPY --from=back-builder /install /usr/local
+
+# Copy people application (see .dockerignore)
+COPY ./src/backend /app/
 
 WORKDIR /app
 
-# Ensure the uv venv is used at runtime
-ENV PATH="/app/.venv/bin:$PATH"
-
-# Generate compiled translation messages
-RUN DJANGO_CONFIGURATION=Build \
-    python manage.py compilemessages --ignore=".venv/**/*"
-
 # We wrap commands run in this container by the following entrypoint that
 # creates a user on-the-fly with the container user ID (see USER) and root group
 # ID.
 ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
 
 # ---- Development image ----
-FROM core AS backend-development
+FROM core as development
 
 # Switch back to the root user to install development dependencies
 USER root:root
 
 # Install psql
-RUN apk add postgresql-client
+RUN apt-get update && \
+    apt-get install -y postgresql-client && \
+    rm -rf /var/lib/apt/lists/*
 
-# Install development dependencies
-RUN --mount=from=ghcr.io/astral-sh/uv:0.9.10,source=/uv,target=/bin/uv \
-    uv sync --all-extras --locked
+# Uninstall people and re-install it in editable mode along with development
+# dependencies
+RUN pip uninstall -y people
+RUN pip install -e .[dev]
 
 # Restore the un-privileged user running the application
 ARG DOCKER_USER
@@ -129,10 +125,10 @@ ENV DB_HOST=postgresql \
     DB_PORT=5432
 
 # Run django development server
-CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]
+CMD python manage.py runserver 0.0.0.0:8000
 
 # ---- Production image ----
-FROM core AS backend-production
+FROM core as production
 
 ARG PEOPLE_STATIC_ROOT=/data/static
 
@@ -151,4 +147,4 @@ COPY --from=link-collector ${PEOPLE_STATIC_ROOT} ${PEOPLE_STATIC_ROOT}
 COPY --from=mail-builder /mail/backend/core/templates/mail /app/core/templates/mail
 
 # The default command runs gunicorn WSGI server in people's main module
-CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/people.py", "people.wsgi:application"]
+CMD gunicorn -c /usr/local/etc/gunicorn/people.py people.wsgi:application

Makefile

@@ -41,9 +41,11 @@ DOCKER_USER         = $(DOCKER_UID):$(DOCKER_GID)
 COMPOSE             = DOCKER_USER=$(DOCKER_USER) docker compose
 COMPOSE_EXEC        = $(COMPOSE) exec
 COMPOSE_EXEC_APP    = $(COMPOSE_EXEC) app-dev
-COMPOSE_RUN         = $(COMPOSE) run --rm --no-deps
+COMPOSE_RUN         = $(COMPOSE) run --rm
 COMPOSE_RUN_APP     = $(COMPOSE_RUN) app-dev
 COMPOSE_RUN_CROWDIN = $(COMPOSE_RUN) crowdin crowdin
+WAIT_DB             = @$(COMPOSE_RUN) dockerize -wait tcp://$(DB_HOST):$(DB_PORT) -timeout 60s
+WAIT_KC_DB          = $(COMPOSE_RUN) dockerize -wait tcp://kc_postgresql:5432 -timeout 60s
 
 # -- Backend
 MANAGE              = $(COMPOSE_RUN_APP) python manage.py
@@ -70,45 +72,28 @@ data/static:
 create-env-files: ## Copy the dist env files to env files
 create-env-files: \
 	env.d/development/common \
-	env.d/development/france \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
 	env.d/development/kc_postgresql
 .PHONY: create-env-files
 
-add-dev-rsa-private-key-to-env: ## Add a generated RSA private key to the env file
-	@echo "Generating RSA private key PEM for development..."
-	@mkdir -p env.d/development/rsa
-	@openssl genrsa -out env.d/development/rsa/private.pem 2048
-	@echo -n "\nOAUTH2_PROVIDER_OIDC_RSA_PRIVATE_KEY=\"" >> env.d/development/common
-	@openssl rsa -in env.d/development/rsa/private.pem -outform PEM >> env.d/development/common
-	@echo "\"" >> env.d/development/common
-	@rm -rf env.d/development/rsa
-.PHONY: add-dev-rsa-private-key-to-env
-
-update-keycloak-realm-app: ## Create the Keycloak realm for the project
-	@echo "$(BOLD)Creating Keycloak realm for 'app'$(RESET)"
-	@sed -i 's|http://app-dev:8000|http://app:8000|g' ./docker/auth/realm.json
-.PHONY: update-keycloak-realm-app
-
 bootstrap: ## Prepare Docker images for the project and install frontend dependencies
 bootstrap: \
 	data/media \
 	data/static \
 	create-env-files \
 	build \
-	run-dev \
+	run \
 	migrate \
 	back-i18n-compile \
 	mails-install \
 	mails-build \
-	dimail-setup-db
+	install-front-desk
 .PHONY: bootstrap
 
 # -- Docker/compose
 build: ## build the app-dev container
-	@$(COMPOSE) build app-dev frontend-dev
-	@$(COMPOSE) build dimail
+	@$(COMPOSE) build app-dev
 .PHONY: build
 
 down: ## stop and remove containers, networks, images, and volumes
@@ -119,14 +104,16 @@ logs: ## display app-dev logs (follow mode)
 	@$(COMPOSE) logs -f app-dev
 .PHONY: logs
 
-run: ## start the wsgi (production) and servers with production Docker images
-	@$(COMPOSE) up --force-recreate --detach app frontend celery celery-beat nginx maildev
+run: ## start the wsgi (production) and development server
+	@$(COMPOSE) up --force-recreate -d nginx
+	@$(COMPOSE) up --force-recreate -d app-dev
+	@$(COMPOSE) up --force-recreate -d celery-dev
+	@$(COMPOSE) up --force-recreate -d keycloak
+	@echo "Wait for postgresql to be up..."
+	@$(WAIT_KC_DB)
+	@$(WAIT_DB)
 .PHONY: run
 
-run-dev: ## start the servers in development mode (watch) Docker images
-	@$(COMPOSE) up --force-recreate --detach app-dev dimail frontend-dev celery-dev celery-beat-dev nginx maildev
-.PHONY: run-dev
-
 status: ## an alias for "docker compose ps"
 	@$(COMPOSE) ps
 .PHONY: status
@@ -140,10 +127,8 @@ stop: ## stop the development server using Docker
 demo: ## flush db then create a demo for load testing purpose
 	@$(MAKE) resetdb
 	@$(MANAGE) create_demo
-	@$(MAKE) dimail-setup-db
 .PHONY: demo
 
-
 # Nota bene: Black should come after isort just in case they don't agree...
 lint: ## lint back-end python sources
 lint: \
@@ -167,14 +152,6 @@ lint-pylint: ## lint back-end python sources with pylint only on changed files f
 	bin/pylint --diff-only=origin/main
 .PHONY: lint-pylint
 
-lint-front: ## lint front-end sources with eslint
-	cd $(PATH_FRONT) && yarn lint
-.PHONY: lint-front
-
-lint-front-fix: ## fix front-end sources with eslint
-	cd $(PATH_FRONT) && yarn lint-fix
-.PHONY: lint-front-fix
-
 test: ## run project tests
 	@$(MAKE) test-back-parallel
 .PHONY: test
@@ -189,37 +166,31 @@ test-back-parallel: ## run all back-end tests in parallel
 	bin/pytest -n auto $${args:-${1}}
 .PHONY: test-back-parallel
 
-test-coverage: ## compute, display and save test coverage
-	bin/pytest --cov=. --cov-report json .
-.PHONY: test-coverage
 
 makemigrations:  ## run django makemigrations for the people project.
 	@echo "$(BOLD)Running makemigrations$(RESET)"
-	@$(MANAGE) makemigrations $(ARGS)
+	@$(COMPOSE) up -d postgresql
+	@$(WAIT_DB)
+	@$(MANAGE) makemigrations
 .PHONY: makemigrations
 
 migrate:  ## run django migrations for the people project.
 	@echo "$(BOLD)Running migrations$(RESET)"
-	@$(MANAGE) migrate $(ARGS)
+	@$(COMPOSE) up -d postgresql
+	@$(WAIT_DB)
+	@$(MANAGE) migrate
 .PHONY: migrate
 
-showmigrations:  ## run django showmigrations for the people project.
-	@echo "$(BOLD)Running showmigrations$(RESET)"
-	@$(MANAGE) showmigrations $(ARGS)
-.PHONY: showmigrations
-
 superuser: ## Create an admin superuser with password "admin"
 	@echo "$(BOLD)Creating a Django superuser$(RESET)"
-	$(MANAGE) createsuperuser --username admin --password admin
-
+	@$(MANAGE) createsuperuser --email admin@example.com --password admin
 .PHONY: superuser
 
 back-i18n-compile: ## compile the gettext files
-	@$(MANAGE) compilemessages --ignore=".venv/**/*"
+	@$(MANAGE) compilemessages --ignore="venv/**/*"
 .PHONY: back-i18n-compile
 
 back-i18n-generate: ## create the .pot files used for i18n
-back-i18n-generate: mails-build crowdin-download-sources
 	@$(MANAGE) makemessages -a --keep-pot
 .PHONY: back-i18n-generate
 
@@ -233,29 +204,25 @@ dbshell: ## connect to database shell
 	docker compose exec app-dev python manage.py dbshell
 .PHONY: dbshell
 
-resetdb: FLUSH_ARGS ?=
 resetdb: ## flush database and create a superuser "admin"
 	@echo "$(BOLD)Flush database$(RESET)"
-	@$(MANAGE) flush $(FLUSH_ARGS)
+	@$(MANAGE) flush
 	@${MAKE} superuser
 .PHONY: resetdb
 
 env.d/development/common:
-	cp --update=none env.d/development/common.dist env.d/development/common
-
-env.d/development/france:
-	cp --update=none env.d/development/france.dist env.d/development/france
+	cp -n env.d/development/common.dist env.d/development/common
 
 env.d/development/postgresql:
-	cp --update=none env.d/development/postgresql.dist env.d/development/postgresql
+	cp -n env.d/development/postgresql.dist env.d/development/postgresql
 
 env.d/development/kc_postgresql:
-	cp --update=none env.d/development/kc_postgresql.dist env.d/development/kc_postgresql
+	cp -n env.d/development/kc_postgresql.dist env.d/development/kc_postgresql
 
 # -- Internationalization
 
 env.d/development/crowdin:
-	cp --update=none env.d/development/crowdin.dist env.d/development/crowdin
+	cp -n env.d/development/crowdin.dist env.d/development/crowdin
 
 crowdin-download: ## Download translated message from Crowdin
 	@$(COMPOSE_RUN_CROWDIN) download -c crowdin/config.yml
@@ -277,7 +244,6 @@ i18n-compile: \
 
 i18n-generate: ## create the .pot files and extract frontend messages
 i18n-generate: \
-	crowdin-download-sources \
 	back-i18n-generate \
 	frontend-i18n-generate
 .PHONY: i18n-generate
@@ -294,23 +260,10 @@ i18n-generate-and-upload: \
   crowdin-upload
 .PHONY: i18n-generate-and-upload
 
-# -- INTEROPERABILTY
-# -- Dimail configuration
-dimail-setup-db:
-	@$(COMPOSE) up --force-recreate -d dimail
-	@echo "$(BOLD)Populating database of local dimail API container$(RESET)"
-	@$(MANAGE) setup_dimail_db --populate-from-people
-.PHONY: dimail-setup-db
 
 # -- Mail generator
 
-mails-clean-templates: ## Clean the generated mail templates directory
-	@echo "$(BOLD)Cleaning mail templates directory$(RESET)"
-	@rm -rf ./src/backend/core/templates/mail
-	@mkdir -p ./src/backend/core/templates/mail
-.PHONY: mails-clean-templates
-
-mails-build: mails-clean-templates ## Convert mjml files to html and text
+mails-build: ## Convert mjml files to html and text
 	@$(MAIL_YARN) build
 .PHONY: mails-build
 
@@ -349,7 +302,7 @@ help:
 
 # Front 
 install-front-desk: ## Install the frontend dependencies of app Desk  
-	cd $(PATH_FRONT_DESK) && yarn && yarn playwright install chromium
+	cd $(PATH_FRONT_DESK) && yarn
 .PHONY: install-front-desk
 
 run-front-desk: ## Start app Desk  
@@ -369,72 +322,3 @@ frontend-i18n-generate: \
 frontend-i18n-compile: ## Format the crowin json files used deploy to the apps
 	cd $(PATH_FRONT) && yarn i18n:deploy
 .PHONY: frontend-i18n-compile
-
-# -- K8S
-start-kind: ## Create the kubernetes cluster
-	./bin/start-kind.sh
-.PHONY: start-kind
-
-install-external-secrets: ## install the kubernetes secrets from Vaultwarden
-	./bin/install-external-secrets.sh
-.PHONY: build-k8s-cluster
-
-tilt-up: ## start tilt - k8s local development
-	tilt up -f ./bin/Tiltfile
-.PHONY: tilt-up
-
-start-tilt-keycloak: ## start the kubernetes cluster using kind, without Pro Connect for authentication, use keycloak
-	DEV_ENV=dev-keycloak tilt up -f ./bin/Tiltfile
-.PHONY: build-k8s-cluster
-
-release:  ## helper for release and deployment
-	python scripts/release.py
-.PHONY: release
-
-install-secret: ## install the kubernetes secrets from Vaultwarden
-	if kubectl -n desk get secrets bitwarden-cli-desk; then \
-		echo "Secret already present"; \
-	else \
-		echo "Please provide the following information:"; \
-		read -p "Enter your vaultwarden email login: " LOGIN; \
-		read -p "Enter your vaultwarden password: " PASSWORD; \
-		read -p "Enter your vaultwarden server url: " URL; \
-		echo "\nCreate vaultwarden secret"; \
-		echo "apiVersion: v1" > /tmp/secret.yaml; \
-		echo "kind: Secret" >> /tmp/secret.yaml; \
-		echo "metadata:" >> /tmp/secret.yaml; \
-		echo "  name: bitwarden-cli-desk" >> /tmp/secret.yaml; \
-		echo "  namespace: desk" >> /tmp/secret.yaml; \
-		echo "type: Opaque" >> /tmp/secret.yaml; \
-		echo "stringData:" >> /tmp/secret.yaml; \
-		echo "  BW_HOST: $$URL" >> /tmp/secret.yaml; \
-		echo "  BW_PASSWORD: $$PASSWORD" >> /tmp/secret.yaml; \
-		echo "  BW_USERNAME: $$LOGIN" >> /tmp/secret.yaml; \
-		kubectl -n desk apply -f /tmp/secret.yaml;\
-		rm -f /tmp/secret.yaml; \
-	fi; \
-	if kubectl get ns external-secrets; then \
-		echo "External secret already deployed"; \
-	else \
-		helm repo add external-secrets https://charts.external-secrets.io; \
-		helm upgrade --install external-secrets \
-      external-secrets/external-secrets \
-       -n external-secrets \
-       --create-namespace \
-       --set installCRDs=true; \
-	fi
-.PHONY: build-k8s-cluster
-
-fetch-domain-status:
-	@$(MANAGE) fetch_domain_status
-.PHONY: fetch-domain-status
-
-# -- Keycloak related
-create-new-client:  ## run the add-keycloak-client.sh script for keycloak.
-	@echo "$(BOLD)Running add-keycloak-client.sh$(RESET)"
-	@$(COMPOSE_RUN) \
-		-v ./scripts/keycloak/add-keycloak-client.sh:/tmp/add-keycloak-client.sh \
-		--entrypoint="/tmp/add-keycloak-client.sh" \
-		keycloak \
-		$(filter-out $@,$(MAKECMDGOALS))
-.PHONY: create-new-client

README.md

@@ -1,12 +1,12 @@
 # People
 
-People is an application to handle users and teams, and distribute permissions across [La Suite](https://lasuite.numerique.gouv.fr/).
+People is an application to handle users and teams. 
 
-It is built on top of [Django Rest
+As of today, this project is **not yet ready for production**. Expect breaking changes.
+
+People is built on top of [Django Rest
 Framework](https://www.django-rest-framework.org/).
 
-All interoperabilities will be described in `docs/interoperability`.
-
 ## Getting started
 
 ### Prerequisite
@@ -25,7 +25,7 @@ $ docker compose -v
 > ⚠️ You may need to run the following commands with `sudo` but this can be
 > avoided by assigning your user to the `docker` group.
 
-### Bootstrap project
+### Project bootstrap
 
 The easiest way to start working on the project is to use GNU Make:
 
@@ -33,12 +33,12 @@ The easiest way to start working on the project is to use GNU Make:
 $ make bootstrap
 ```
 
-This command builds the `app-dev` container, installs dependencies, performs
+This command builds the `app` container, installs dependencies, performs
 database migrations and compile translations. It's a good idea to use this
 command each time you are pulling code from the project repository to avoid
 dependency-related or migration-related issues.
 
-Your Docker services should now be up and running! 🎉
+Your Docker services should now be up and running 🎉
 
 Note that if you need to run them afterward, you can use the eponym Make rule:
 
@@ -46,13 +46,13 @@ Note that if you need to run them afterward, you can use the eponym Make rule:
 $ make run
 ```
 
-or if you want to run them in development mode (with live reloading):
+### Adding content
 
-```bash
-$ make run-dev
-```
+You can create a basic demo site by running:
 
-You can check all available Make rules using:
+    $ make demo
+
+Finally, you can check all available Make rules using:
 
 ```bash
 $ make help
@@ -69,37 +69,6 @@ You first need to create a superuser account:
 $ make superuser
 ```
 
-You can then login with sub `admin` and password `admin`.
-
-### Adding demo content
-
-You can create a basic demo site by running:
-
-```bash
-$ make demo
-```
-
-### Setting dimail database 
-
-To ease local development when working on interoperability between people and dimail, we embark dimail-api in a container running in "fake" mode. 
-
-To populate dimail local database with users/domains/permissions needed for basic development:
-- log in with "people" user
-- run `make dimail-setup-db`
-
-
-### Run frontend
-
-Run the front with:
-
-```bash
-$ make run-front-desk
-```
-
-Then access [http://localhost:3000](http://localhost:3000) with :
-user: people
-password: people
-
 ## Contributing
 
 This project is intended to be community-driven, so please, do not hesitate to

SECURITY.md

@@ -1,23 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-Security is very important to us.
-
-If you have any issue regarding security, please disclose the information responsibly submiting [this form](https://vdp.numerique.gouv.fr/p/Send-a-report?lang=en) and not by creating an issue on the repository. You can also email us at support-regie@numerique.gouv.fr
-
-We appreciate your effort to make People more secure.
-
-## Vulnerability disclosure policy
-
-Working with security issues in an open source project can be challenging, as we are required to disclose potential problems that could be exploited by attackers. With this in mind, our security fix policy is as follows:
-
-1. The Maintainers team will handle the fix as usual (Pull Request,
-release).
-2. In the release notes, we will include the identification numbers from the
-GitHub Advisory Database (GHSA) and, if applicable, the Common Vulnerabilities
-and Exposures (CVE) identifier for the vulnerability.
-3. Once this grace period has passed, we will publish the vulnerability.
-
-By adhering to this security policy, we aim to address security concerns
-effectively and responsibly in our open source software project.

bin/Tiltfile

@@ -1,103 +0,0 @@
-load('ext://uibutton', 'cmd_button', 'bool_input', 'location')
-load('ext://namespace', 'namespace_create', 'namespace_inject')
-namespace_create('desk')
-
-docker_build(
-    'localhost:5001/people-backend:latest',
-    context='..',
-    dockerfile='../Dockerfile',
-    only=['./src/backend', './src/mail', './docker'],
-    target = 'backend-production',
-    live_update=[
-        sync('../src/backend', '/app'),
-        run(
-            'pip install -r /app/requirements.txt',
-            trigger=['./api/requirements.txt']
-        )
-    ]
-)
-
-docker_build(
-    'localhost:5001/people-frontend:latest',
-    context='..',
-    dockerfile='../Dockerfile',
-    build_args={'ENV': 'dev'},
-    only=['./src/frontend', './src/mail', './docker'],
-    target = 'frontend-builder-dev',
-    live_update=[
-        sync('../src/frontend', '/builder'),
-    ]
-)
-
-# helmfile in docker mount the current working directory and the helmfile.yaml
-# requires the keycloak config in another directory
-k8s_yaml(local('cd .. && helmfile -n desk -e ${DEV_ENV:-dev} template --file ./src/helm/helmfile.yaml'))
-
-migration = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py makemigrations
-'''
-cmd_button('Make migration',
-           argv=['sh', '-c', migration],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Run makemigration',
-)
-
-pod_migrate = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py migrate --no-input
-'''
-cmd_button('Migrate db',
-           argv=['sh', '-c', pod_migrate],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Run database migration',
-)
-
-# Command to reset DB
-reset_db = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py flush --no-input
-kubectl -n desk exec "$POD_NAME" -- python manage.py createsuperuser --username admin@example.com --password admin
-'''
-cmd_button('Reset DB',
-           argv=['sh', '-c', reset_db],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Reset DB',
-)
-
-# Command to create demo data
-populate_people_with_demo_data = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py create_demo --force
-'''
-cmd_button('Populate with demo data',
-           argv=['sh', '-c', populate_people_with_demo_data],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Populate with demo data',
-)
-
-# Command to created domain/users/access from people to dimail
-populate_dimail_from_people = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py setup_dimail_db --populate-from-people
-'''
-cmd_button('Populate dimail from people',
-           argv=['sh', '-c', populate_dimail_from_people],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Populate dimail from people',
-)

bin/_config.sh

@@ -5,6 +5,7 @@ set -eo pipefail
 REPO_DIR="$(cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd)"
 UNSET_USER=0
 
+TERRAFORM_DIRECTORY="./env.d/terraform"
 COMPOSE_FILE="${REPO_DIR}/docker-compose.yml"
 COMPOSE_PROJECT="people"
 
@@ -64,23 +65,6 @@ function _dc_run() {
     _docker_compose run --rm $user_args "$@"
 }
 
-# _dc_run_no_deps: wrap docker compose run command without dependencies
-#
-# usage: _dc_run_no_deps [options] [ARGS...]
-#
-# options: docker compose run command options
-# ARGS   : docker compose run command arguments
-function _dc_run_no_deps() {
-    _set_user
-
-    user_args="--user=$USER_ID"
-    if [ -z $USER_ID ]; then
-        user_args=""
-    fi
-
-    _docker_compose run --no-deps --rm $user_args "$@"
-}
-
 # _dc_exec: wrap docker compose exec command
 #
 # usage: _dc_exec [options] [ARGS...]
@@ -108,3 +92,66 @@ function _dc_exec() {
 function _django_manage() {
     _dc_run "app-dev" python manage.py "$@"
 }
+
+# _set_openstack_project: select an OpenStack project from the openrc files defined in the
+# terraform directory.
+#
+# usage: _set_openstack_project
+#
+# If necessary the script will prompt the user to choose a project from those available
+function _set_openstack_project() {
+
+    declare prompt
+    declare -a projects
+    declare -i default=1
+    declare -i choice=0
+    declare -i n_projects
+
+    # List projects by looking in the "./env.d/terraform" directory
+    # and store them in an array
+    read -r -a projects <<< "$(
+        find "${TERRAFORM_DIRECTORY}" -maxdepth 1 -mindepth 1 -type d |
+        sed 's|'"${TERRAFORM_DIRECTORY}\/"'||' |
+        xargs
+    )"
+    nb_projects=${#projects[@]}
+
+    if [[ ${nb_projects} -le 0 ]]; then
+        echo "There are no OpenStack projects defined..." >&2
+        echo "To add one, create a subdirectory in \"${TERRAFORM_DIRECTORY}\" with the name" \
+            "of your project and copy your \"openrc.sh\" file into it." >&2
+        exit 10
+    fi
+
+    if [[ ${nb_projects} -gt 1 ]]; then
+        prompt="Select an OpenStack project to target:\\n"
+        for (( i=0; i<nb_projects; i++ )); do
+            prompt+="[$((i+1))] ${projects[$i]}"
+            if [[ $((i+1)) -eq ${default} ]]; then
+                prompt+=" (default)"
+            fi
+            prompt+="\\n"
+        done
+        prompt+="If your OpenStack project is not listed, add it to the \"env.d/terraform\" directory.\\n"
+        prompt+="Your choice: "
+        read -r -p "$(echo -e "${prompt}")" choice
+
+        if [[ ${choice} -gt nb_projects ]]; then
+            (>&2 echo "Invalid choice ${choice} (should be <= ${nb_projects})")
+            exit 11
+        fi
+
+        if [[ ${choice} -le 0 ]]; then
+            choice=${default}
+        fi
+    fi
+
+    project=${projects[$((choice-1))]}
+    # Check that the openrc.sh file exists for this project
+    if [ ! -f "${TERRAFORM_DIRECTORY}/${project}/openrc.sh" ]; then
+        (>&2 echo "Missing \"openrc.sh\" file in \"${TERRAFORM_DIRECTORY}/${project}\". Check documentation.")
+        exit 12
+    fi
+
+    echo "${project}"
+}

bin/install-external-secrets.sh

@@ -1,90 +0,0 @@
-#!/usr/bin/env bash
-set -o errexit
-
-CURRENT_DIR=$(pwd)
-NAMESPACE=${1:-desk}
-SECRET_NAME=${2:-bitwarden-cli-desk}
-TEMP_SECRET_FILE=$(mktemp)
-
-
-cleanup() {
-    rm -f "${TEMP_SECRET_FILE}"
-}
-trap cleanup EXIT
-
-
-# Check if kubectl is available
-check_prerequisites() {
-    if ! command -v kubectl &> /dev/null; then
-        echo "Error: kubectl is not installed or not in PATH"
-        exit 1
-    fi
-}
-
-# Check if secret already exists
-check_secret_exists() {
-    kubectl -n "${NAMESPACE}" get secrets "${SECRET_NAME}" &> /dev/null
-}
-
-
-# Collect user input securely
-get_user_input() {
-    echo "Please provide the following information:"
-    read -p "Enter your Vaultwarden email login: " LOGIN
-    read -s -p "Enter your Vaultwarden password: " PASSWORD
-    echo
-    read -p "Enter your Vaultwarden server url: " URL
-}
-
-# Create and apply the secret
-create_secret() {
-    cat > "${TEMP_SECRET_FILE}" << EOF
-apiVersion: v1
-kind: Secret
-metadata:
-  name: ${SECRET_NAME}
-  namespace: ${NAMESPACE}
-type: Opaque
-stringData:
-  BW_HOST: ${URL}
-  BW_PASSWORD: ${PASSWORD}
-  BW_USERNAME: ${LOGIN}
-EOF
-
-    kubectl -n "${NAMESPACE}" apply -f "${TEMP_SECRET_FILE}"
-}
-
-# Install external-secrets using Helm
-install_external_secrets() {
-    if ! kubectl get ns external-secrets &>/dev/null; then
-        echo "Installing external-secrets…"
-        helm repo add external-secrets https://charts.external-secrets.io
-        helm upgrade --install external-secrets \
-            external-secrets/external-secrets \
-            -n external-secrets \
-            --create-namespace \
-            --set installCRDs=true
-    else
-        echo "External secrets already deployed"
-    fi
-}
-
-main() {
-    check_prerequisites
-
-    if check_secret_exists; then
-        echo "Secret '${SECRET_NAME}' already present in namespace '${NAMESPACE}'"
-        exit 0
-    fi
-
-    echo -e ${TEMP_SECRET_FILE}
-
-    get_user_input
-    echo -e "\nCreating Vaultwarden secret…"
-    create_secret
-    install_external_secrets
-
-    echo "Secret installation completed successfully"
-}
-
-main "$@"

bin/pylint

@@ -35,4 +35,4 @@ fi
 
 # Fix docker vs local path when project sources are mounted as a volume
 read -ra paths <<< "$(echo "${paths[@]}" | sed "s|src/backend/||g")"
-_dc_run_no_deps app-dev pylint "${paths[@]}" "${args[@]}"
+_dc_run app-dev pylint "${paths[@]}" "${args[@]}"

bin/start-kind.sh

@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-curl https://raw.githubusercontent.com/numerique-gouv/tools/refs/heads/main/kind/create_cluster.sh | bash -s -- desk

bin/state

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
+
+project=$(_set_openstack_project)
+echo "Using \"${project}\" project..."
+
+source "${TERRAFORM_DIRECTORY}/${project}/openrc.sh"
+
+# Run Terraform commands in the Hashicorp docker container via docker compose
+# shellcheck disable=SC2068
+DOCKER_USER="$(id -u):$(id -g)" \
+    PROJECT="${project}" \
+    docker compose run --rm \
+    -e OS_AUTH_URL \
+    -e OS_IDENTITY_API_VERSION \
+    -e OS_USER_DOMAIN_NAME \
+    -e OS_PROJECT_DOMAIN_NAME \
+    -e OS_TENANT_ID \
+    -e OS_TENANT_NAME \
+    -e OS_USERNAME \
+    -e OS_PASSWORD \
+    -e OS_REGION_NAME \
+    terraform-state "$@"

bin/terraform

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
+
+project=$(_set_openstack_project)
+echo "Using \"${project}\" project..."
+
+source "${TERRAFORM_DIRECTORY}/${project}/openrc.sh"
+
+# Run Terraform commands in the Hashicorp docker container via docker compose
+# shellcheck disable=SC2068
+DOCKER_USER="$(id -u):$(id -g)" \
+    PROJECT="${project}" \
+    docker compose run --rm \
+    -e OS_AUTH_URL \
+    -e OS_IDENTITY_API_VERSION \
+    -e OS_USER_DOMAIN_NAME \
+    -e OS_PROJECT_DOMAIN_NAME \
+    -e OS_TENANT_ID \
+    -e OS_TENANT_NAME \
+    -e OS_USERNAME \
+    -e OS_PASSWORD \
+    -e OS_REGION_NAME \
+    -e TF_VAR_user_name \
+    terraform "$@"

docker-compose.yml

@@ -1,40 +1,34 @@
+version: '3.8'
+
 services:
   postgresql:
     image: postgres:16
-    platform: linux/amd64
     env_file:
       - env.d/development/postgresql
     ports:
       - "15432:5432"
-    healthcheck:
-      test: [ "CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}" ]
-      interval: 1s
-      timeout: 2s
-      retries: 300
 
   redis:
     image: redis:5
 
-  maildev:
-    image: maildev/maildev:latest
+  mailcatcher:
+    image: sj26/mailcatcher:latest
     ports:
       - "1081:1080"
 
   app-dev:
     build:
       context: .
-      target: backend-development
+      target: development
       args:
         DOCKER_USER: ${DOCKER_USER:-1000}
     user: ${DOCKER_USER:-1000}
-    image: people:backend-development
-    pull_policy: never
+    image: people:development
     environment:
       - PYLINTHOME=/app/.pylint.d
       - DJANGO_CONFIGURATION=Development
     env_file:
       - env.d/development/common
-      - env.d/development/france
       - env.d/development/postgresql
     ports:
       - "8071:8000"
@@ -42,72 +36,14 @@ services:
       - ./src/backend:/app
       - ./data/media:/data/media
       - ./data/static:/data/static
-      - /app/.venv
     depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
-      maildev:
-        condition: service_started
-      redis:
-        condition: service_started
-
-  frontend-dev:
-    user: "${DOCKER_USER:-1000}"
-    build:
-      context: .
-      dockerfile: ./src/frontend/Dockerfile
-      target: frontend-dev
-    image: people:frontend-development
-    pull_policy: never
-    volumes:
-      - ./src/frontend:/home/frontend
-      - /home/frontend/node_modules
-      - /home/frontend/apps/desk/node_modules
-    ports:
-      - "3000:3000"
-
-  app:
-    build:
-      context: .
-      target: backend-production
-      args:
-        DOCKER_USER: ${DOCKER_USER:-1000}
-    user: ${DOCKER_USER:-1000}
-    image: people:backend-production
-    environment:
-      - DJANGO_CONFIGURATION=Development
-    env_file:
-      - env.d/development/common
-      - env.d/development/france
-      - env.d/development/postgresql
-    ports:
-      - "8071:8000"
-    volumes:
-      - ./data/media:/data/media
-    depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
-      redis:
-        condition: service_started
-
-  frontend:
-    user: "${DOCKER_USER:-1000}"
-    build:
-      context: .
-      dockerfile: ./src/frontend/Dockerfile
-      target: frontend-production
-      args:
-        API_ORIGIN: "http://localhost:8071"
-    image: people:frontend-production
-    pull_policy: build
-    ports:
-      - "3000:3000"
-
+        - postgresql
+        - mailcatcher
+        - redis
+  
   celery-dev:
     user: ${DOCKER_USER:-1000}
-    image: people:backend-development
+    image: people:development
     command: ["celery", "-A", "people.celery_app", "worker", "-l", "DEBUG"]
     environment:
       - DJANGO_CONFIGURATION=Development
@@ -118,35 +54,31 @@ services:
       - ./src/backend:/app
       - ./data/media:/data/media
       - ./data/static:/data/static
-      - /app/.venv
     depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
-      app-dev:
-        condition: service_started
+      - app-dev
 
-  celery-beat-dev:
+  app:
+    build:
+      context: .
+      target: production
+      args:
+        DOCKER_USER: ${DOCKER_USER:-1000}
     user: ${DOCKER_USER:-1000}
-    image: people:backend-development
-    command: ["celery", "-A", "people.celery_app", "beat", "-l", "DEBUG"]
+    image: people:production
     environment:
-      - DJANGO_CONFIGURATION=Development
+      - DJANGO_CONFIGURATION=Demo
     env_file:
       - env.d/development/common
       - env.d/development/postgresql
     volumes:
-      - ./src/backend:/app
       - ./data/media:/data/media
-      - ./data/static:/data/static
     depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
+      - postgresql
+      - redis
 
   celery:
     user: ${DOCKER_USER:-1000}
-    image: people:backend-production
+    image: people:production
     command: ["celery", "-A", "people.celery_app", "worker", "-l", "INFO"]
     environment:
       - DJANGO_CONFIGURATION=Demo
@@ -154,43 +86,27 @@ services:
       - env.d/development/common
       - env.d/development/postgresql
     depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
-      app:
-        condition: service_started
-
-  celery-beat:
-    user: ${DOCKER_USER:-1000}
-    image: people:backend-production
-    command: ["celery", "-A", "people.celery_app", "beat", "-l", "INFO"]
-    environment:
-      - DJANGO_CONFIGURATION=Demo
-    env_file:
-      - env.d/development/common
-      - env.d/development/postgresql
-    volumes:
-      - ./src/backend:/app
-      - ./data/media:/data/media
-      - ./data/static:/data/static
-    depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
+      - app
 
   nginx:
     image: nginx:1.25
     ports:
+      - "8082:8082"
       - "8083:8083"
+      - "8088:8088"
     volumes:
       - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
+      - ./src/frontend/apps/desk/out:/home/desk
+      - ./data/media:/data/media:ro
     depends_on:
-      keycloak:
-        condition: service_healthy
-        restart: true
+      - app
+      - keycloak
+
+  dockerize:
+    image: jwilder/dockerize
 
   crowdin:
-    image: crowdin/cli:4.6.1
+    image: crowdin/cli:3.16.0
     volumes:
       - ".:/app"
     env_file:
@@ -199,31 +115,41 @@ services:
     working_dir: /app
 
   node:
-    image: node:22
+    image: node:18
     user: "${DOCKER_USER:-1000}"
     environment:
       HOME: /tmp
     volumes:
       - ".:/app"
 
+  terraform-state:
+    image: hashicorp/terraform:1.6
+    environment:
+      - TF_WORKSPACE=${PROJECT:-} # avoid env conflict in local state
+    user: ${DOCKER_USER:-1000}
+    working_dir: /app
+    volumes:
+      - ./src/terraform/create_state_bucket:/app
+
+  terraform:
+    image: hashicorp/terraform:1.6
+    user: ${DOCKER_USER:-1000}
+    working_dir: /app
+    volumes:
+      - ./src/terraform:/app
+
   kc_postgresql:
-    image: postgres:14.3
-    ports:
-      - "5433:5432"
-    env_file:
-      - env.d/development/kc_postgresql
-    healthcheck:
-      test: [ "CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}" ]
-      interval: 1s
-      timeout: 2s
-      retries: 300
+      image: postgres:14.3
+      platform: linux/amd64
+      ports:
+        - "5433:5432"
+      env_file:
+        - env.d/development/kc_postgresql
 
   keycloak:
     image: quay.io/keycloak/keycloak:20.0.1
     volumes:
       - ./docker/auth/realm.json:/opt/keycloak/data/import/realm.json
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     command:
       - start-dev
       - --features=preview
@@ -233,8 +159,6 @@ services:
       - --hostname-admin-url=http://localhost:8083/
       - --hostname-strict=false
       - --hostname-strict-https=false
-      - --health-enabled=true
-      - --metrics-enabled=true
     environment:
       KEYCLOAK_ADMIN: admin
       KEYCLOAK_ADMIN_PASSWORD: admin
@@ -245,41 +169,7 @@ services:
       KC_DB_USERNAME: people
       KC_DB_SCHEMA: public
       PROXY_ADDRESS_FORWARDING: 'true'
-    healthcheck:
-      test: [ "CMD", "curl", "--head", "-fsS", "http://localhost:8080/health/ready" ]
-      interval: 1s
-      timeout: 2s
-      retries: 300
     ports:
       - "8080:8080"
     depends_on:
-      kc_postgresql:
-        condition: service_healthy
-        restart: true
-
-  dimail: 
-    entrypoint: /opt/dimail-api/start-dev.sh
-    image: registry.mim-libre.fr/dimail/dimail-api:v0.5.2
-    pull_policy: always
-    environment:
-      DIMAIL_MODE: FAKE
-      DIMAIL_JWT_SECRET: fake_jwt_secret
-    ports:
-      - "8001:8000"
-
-  flower-dev:
-    user: ${DOCKER_USER:-1000}
-    image: people:backend-development
-    command: ["celery", "-A", "people.celery_app", "flower", "--port=5555"]
-    environment:
-      - DJANGO_CONFIGURATION=Development
-    env_file:
-      - env.d/development/common
-      - env.d/development/postgresql
-    ports:
-      - "5555:5555"
-    volumes:
-      - ./src/backend:/app
-    depends_on:
-      - celery-dev
-      - redis
+      - kc_postgresql

docker/auth/realm.json

@@ -26,7 +26,7 @@
   "oauth2DeviceCodeLifespan": 600,
   "oauth2DevicePollingInterval": 5,
   "enabled": true,
-  "sslRequired": "none",
+  "sslRequired": "external",
   "registrationAllowed": true,
   "registrationEmailAsUsername": false,
   "rememberMe": true,
@@ -50,9 +50,6 @@
       "firstName": "John",
       "lastName": "Doe",
       "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
       "credentials": [
         {
           "type": "password",
@@ -61,32 +58,12 @@
       ],
       "realmRoles": ["user"]
     },
-    {
-      "username": "e2e.marie",
-      "email": "marie.varzy@gmail.com",
-      "firstName": "Marie",
-      "lastName": "Delamairie",
-      "enabled": true,
-      "attributes": {
-          "siret": "21510339100011"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.marie"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
     {
       "username": "user-e2e-chromium",
-      "email": "user-e2e-chromium@example.org",
+      "email": "user@chromium.e2e",
       "firstName": "E2E",
       "lastName": "Chromium",
       "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
       "credentials": [
         {
           "type": "password",
@@ -97,13 +74,10 @@
     },
     {
       "username": "user-e2e-webkit",
-      "email": "user-e2e-webkit@example.org",
+      "email": "user@webkit.e2e",
       "firstName": "E2E",
       "lastName": "Webkit",
       "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
       "credentials": [
         {
           "type": "password",
@@ -114,13 +88,10 @@
     },
     {
       "username": "user-e2e-firefox",
-      "email": "user-e2e-firefox@example.org",
+      "email": "user@firefox.e2e",
       "firstName": "E2E",
       "lastName": "Firefox",
       "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
       "credentials": [
         {
           "type": "password",
@@ -128,261 +99,6 @@
         }
       ],
       "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.team-member",
-      "email": "e2e.team-member@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Member",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-member"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-        {
-      "username": "e2e.team-administrator",
-      "email": "e2e.team-administrator@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Administrator",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-administrator"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-        {
-      "username": "e2e.team-owner",
-      "email": "e2e.team-owner@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Owner",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-owner"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.mail-member",
-      "email": "e2e.mail-member@example.com",
-      "firstName": "E2E",
-      "lastName": "Mailbox Member",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.mail-member"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.mail-administrator",
-      "email": "e2e.mail-administrator@example.com",
-      "firstName": "E2E",
-      "lastName": "Mailbox Administrator",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.mail-administrator"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.mail-owner",
-      "email": "e2e.mail-owner@example.com",
-      "firstName": "E2E",
-      "lastName": "Mailbox Owner",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.mail-owner"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.team-member-mail-member",
-      "email": "e2e.team-member-mail-member@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Member Mailbox Member",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-member-mail-member"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.team-member-mail-administrator",
-      "email": "e2e.team-member-mail-administrator@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Member Mailbox Administrator",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-member-mail-administrator"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.team-member-mail-owner",
-      "email": "e2e.team-member-mail-owner@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Member Mailbox Owner",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-member-mail-owner"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.team-administrator-mail-member",
-      "email": "e2e.team-administrator-mail-member@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Administrator Mailbox Member",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-administrator-mail-member"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.team-administrator-mail-administrator",
-      "email": "e2e.team-administrator-mail-administrator@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Administrator Mailbox Administrator",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-administrator-mail-administrator"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.team-administrator-mail-owner",
-      "email": "e2e.team-administrator-mail-owner@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Administrator Mailbox Owner",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-administrator-mail-owner"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.team-owner-mail-member",
-      "email": "e2e.team-owner-mail-member@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Owner Mailbox Member",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-owner-mail-member"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.team-owner-mail-administrator",
-      "email": "e2e.team-owner-mail-administrator@example.com",
-      "firstName": "E2E",
-      "lastName": "Group Owner Mailbox Administrator",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-owner-mail-administrator"
-        }
-      ],
-      "realmRoles": ["user"]
-    },
-    {
-      "username": "e2e.team-owner-mail-owner",
-      "email": "e2e.team-owner-mail-owner@example.com",
-      "firstName": "E2E",
-      "lastName": "Mailbox Owner",
-      "enabled": true,
-      "attributes": {
-          "siret": "13002526500013"
-      },
-      "credentials": [
-        {
-          "type": "password",
-          "value": "password-e2e.team-owner-mail-owner"
-        }
-      ],
-      "realmRoles": ["user"]
     }
   ],
   "roles": {
@@ -769,17 +485,9 @@
   "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false,
   "webAuthnPolicyPasswordlessAcceptableAaguids": [],
   "scopeMappings": [
-    {
-      "clientScope": "siret",
-      "roles": [
-        "user"
-      ]
-    },
     {
       "clientScope": "offline_access",
-      "roles": [
-        "offline_access"
-      ]
+      "roles": ["offline_access"]
     }
   ],
   "clientScopeMappings": {
@@ -1029,7 +737,6 @@
         "acr",
         "roles",
         "profile",
-        "siret",
         "email"
       ],
       "optionalClientScopes": [
@@ -1190,35 +897,6 @@
         }
       ]
     },
-    {
-      "id": "eb220fbb-02ac-4105-95a3-727954f6565d",
-      "name": "siret",
-      "description": "siret",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "true",
-        "display.on.consent.screen": "false",
-        "gui.order": ""
-      },
-      "protocolMappers": [
-        {
-          "id": "333a4e89-9363-4c36-b56f-79c6b019c6c6",
-          "name": "siret",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "aggregate.attrs": "false",
-            "userinfo.token.claim": "true",
-            "multivalued": "false",
-            "user.attribute": "siret",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "siret"
-          }
-        }
-      ]
-    },
     {
       "id": "af52ccc3-4ecb-49b4-9a67-5d4172f16070",
       "name": "role_list",
@@ -1685,8 +1363,7 @@
     "email",
     "roles",
     "web-origins",
-    "acr",
-    "siret"
+    "acr"
   ],
   "defaultOptionalClientScopes": [
     "offline_access",
@@ -1709,130 +1386,8 @@
   "enabledEventTypes": [],
   "adminEventsEnabled": false,
   "adminEventsDetailsEnabled": false,
-  "identityProviders": [
-    {
-      "alias": "oidc-people-local",
-      "displayName": "People OIDC (local)",
-      "internalId": "47aa6d7c-8ac5-4178-934e-66f78e510ee4",
-      "providerId": "oidc",
-      "enabled": true,
-      "updateProfileFirstLoginMode": "on",
-      "trustEmail": false,
-      "storeToken": false,
-      "addReadTokenRoleOnCreate": false,
-      "authenticateByDefault": false,
-      "linkOnly": false,
-      "firstBrokerLoginFlowAlias": "first broker login",
-      "config": {
-        "hideOnLoginPage": "false",
-        "userInfoUrl": "http://app-dev:8000/o/userinfo/",
-        "validateSignature": "true",
-        "acceptsPromptNoneForwardFromClient": "false",
-        "clientId": "people-idp",
-        "tokenUrl": "http://app-dev:8000/o/token/",
-        "uiLocales": "false",
-        "jwksUrl": "http://app-dev:8000/o/.well-known/jwks.json",
-        "backchannelSupported": "false",
-        "issuer": "http://app-dev:8000/o",
-        "useJwksUrl": "true",
-        "loginHint": "true",
-        "pkceEnabled": "true",
-        "pkceMethod": "S256",
-        "authorizationUrl": "http://localhost:8071/o/authorize/",
-        "clientAuthMethod": "client_secret_post",
-        "disableUserInfo": "false",
-        "syncMode": "IMPORT",
-        "clientSecret": "local-tests-only",
-        "passMaxAge": "false",
-        "defaultScope": "openid given_name usual_name email siret",
-        "allowedClockSkew": "0"
-      }
-    }
-  ],
-  "identityProviderMappers": [
-    {
-      "id": "e55dc88c-7bb5-46fb-95ad-1df701a96282",
-      "name": "Sub",
-      "identityProviderAlias": "oidc-people-local",
-      "identityProviderMapper": "oidc-username-idp-mapper",
-      "config": {
-        "template": "${CLAIM.sub}",
-        "are.claim.values.regex": "false",
-        "claims": "[{\"key\":\"\",\"value\":\"\"}]",
-        "syncMode": "FORCE",
-        "attributes": "[]",
-        "target": "BROKER_ID"
-      }
-    },
-    {
-      "id": "7e489676-8cba-49e4-aa1e-dcd1462d33f7",
-      "name": "given_name",
-      "identityProviderAlias": "oidc-people-local",
-      "identityProviderMapper": "hardcoded-attribute-idp-mapper",
-      "config": {
-        "claims": "[{\"key\":\"\",\"value\":\"\"}]",
-        "syncMode": "FORCE",
-        "are.claim.values.regex": "false",
-        "attributes": "[]",
-        "attribute": "firstName"
-      }
-    },
-    {
-      "id": "30b6b3bc-5738-4936-bf88-c540b8805998",
-      "name": "usual_name",
-      "identityProviderAlias": "oidc-people-local",
-      "identityProviderMapper": "oidc-user-attribute-idp-mapper",
-      "config": {
-        "template": "${ALIAS}.${CLAIM.preferred_username}",
-        "are.claim.values.regex": "false",
-        "claims": "[{\"key\":\"profile\",\"value\":\"lastName\"}]",
-        "syncMode": "FORCE",
-        "claim": "profile",
-        "user.attribute": "lastName",
-        "attributes": "[]",
-        "target": "LOCAL"
-      }
-    },
-    {
-      "id": "b67caa26-4571-4cfe-9c15-68e022645fc5",
-      "name": "Username",
-      "identityProviderAlias": "oidc-people-local",
-      "identityProviderMapper": "oidc-username-idp-mapper",
-      "config": {
-        "template": "${CLAIM.email | lowercase}",
-        "are.claim.values.regex": "false",
-        "claims": "[{\"key\":\"\",\"value\":\"\"}]",
-        "syncMode": "FORCE",
-        "attributes": "[]",
-        "target": "BROKER_USERNAME"
-      }
-    },
-    {
-      "id": "4eef21ce-b5f7-4753-bd58-4e50eb2b5f31",
-      "name": "Email",
-      "identityProviderAlias": "oidc-people-local",
-      "identityProviderMapper": "oidc-user-attribute-idp-mapper",
-      "config": {
-        "are.claim.values.regex": "false",
-        "claims": "[{\"key\":\"\",\"value\":\"\"}]",
-        "syncMode": "FORCE",
-        "claim": "email",
-        "user.attribute": "email",
-        "attributes": "[]"
-      }
-    },
-    {
-      "id": "084cdd0e-0794-4388-8474-84c9a7c1b9c8",
-      "name": "siret",
-      "identityProviderAlias": "oidc-people-local",
-      "identityProviderMapper": "oidc-user-attribute-idp-mapper",
-      "config": {
-        "syncMode": "FORCE",
-        "claim": "siret",
-        "user.attribute": "siret"
-      }
-    }
-  ],
+  "identityProviders": [],
+  "identityProviderMappers": [],
   "components": {
     "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [
       {
@@ -2374,7 +1929,7 @@
           "authenticatorConfig": "review profile config",
           "authenticator": "idp-review-profile",
           "authenticatorFlow": false,
-          "requirement": "DISABLED",
+          "requirement": "REQUIRED",
           "priority": 10,
           "autheticatorFlow": false,
           "userSetupAllowed": false

docker/files/etc/nginx/conf.d/default.conf

@@ -1,3 +1,37 @@
+server {
+
+    listen 8082;
+    server_name localhost;
+    charset utf-8;
+
+    location /media {
+        alias /data/media;
+    }
+
+    location / {
+         proxy_pass http://app:8000;
+         proxy_set_header Host $host;
+         proxy_set_header X-Real-IP $remote_addr;
+         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+}
+
+server {
+  listen 8088;
+  server_name localhost;
+ 
+  root /home/desk;
+ 
+  location / {
+      try_files $uri index.html $uri/ =404;
+  }
+ 
+  error_page 404 /404.html;
+  location = /404.html {
+      internal;
+  }
+}
+
 
 server {
     listen 8083;
@@ -11,3 +45,4 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     }
 }
+

docs/i18n.md

@@ -1,63 +0,0 @@
-# Internationalization (i18n)
-
-The backend and the frontend of the application are internationalized.
-This means that the application can be translated into different languages. 
-The application is currently available in English and French.
-
-## Local setup
-
-To be able to upload/retrieve translation files to/from Crowdin you need to
-setup your local environment with the following environment variables:
-
-```bash
-cp ./env.d/development/crowdin.dist ./env.d/development/crowdin
-```
-
-Then fill "CROWDIN_API_TOKEN" with your token and "CROWDIN_PROJECT_ID" with the project id
-in the `./env.d/development/crowdin` file.
-
-NB: If you don't have a personal Crowdin API token, go to Crowdin interface to generate it: 
-Settings -> API -> Personal Access Tokens -> New token
-
-This configuration file will be loaded by the crowdin docker instance.
-
-
-## How to update the translations
-
-### First way (safe way)
-
-1/ Generate the translation files for both frontend and backend
-  ```bash
-  make i18n-generate
-  ```
-  Check locally everything is ok before uploading the files to the translation platform.
-
-2/ Upload the files to the translation platform (crowdin):
-  ```bash
-  make crowdin-upload
-  ```
-
-3/ Fill the missing translations on the translation platform:
-
-  => [https://crowdin.com/project/lasuite-people](https://crowdin.com/project/lasuite-people)  
-
-4/ Download the translated files from the translation platform and compile them:
-  ```bash
-  make i18n-download-and-compile
-  ```
-
-### Second way (faster way)
-
-1/ Generate the translation files for both frontend and backend and upload them to the translation platform (crowdin):
-  ```bash
-  make i18n-generate-and-upload
-  ```
-
-2/ Fill the missing translations on the translation platform:
-  
-  => [https://crowdin.com/project/lasuite-people](https://crowdin.com/project/lasuite-people)  
-
-3/ Download the translated files from the translation platform and compile them:
-  ```bash
-  make i18n-download-and-compile
-  ```

docs/identityProvider.md

@@ -1,100 +0,0 @@
-# People as an Identity Provider
-
-The people project can be configured to act as an Identity Provider for an OIDC federation.
-
-The model containing the "identity" in `people` is the `Mailbox` model.
-
-The connection workflow looks like:
-
- - The user tries to reach a service provider.
- - The service provider redirects the user to OIDC federation (in dev we use Keycloak).
- - The user asks (or is redirected) to the Identity Provider (people).
- - The user enter their email and password.
- - If successful, the user is redirected to the OIDC federation with a token.
- - The federation make the same Authorization Flow as usual to authenticate on the Service Provider.
-
-
-## Technical aspects
-
-### The `Mailbox` model
-
-The `Mailbox` model can behave like a usual Django user:
-
- - It has a `password` field (and `last_login`)
- - It is considered as `authenticated`.
- - To be `active` it must have an `enabled` status.
- - To be able to log in, it must also have a `MailboxDomain` with an `enabled` status and an associated `Organization`.
-
-### The `MailboxModelBackend` authentication backend
-
-This authentication backend only allow authentication with `email` and `password` with a `Mailbox` user.
-This backend is combined with the `one_time_email_authenticated_session` middleware to restrict
-the session to the OIDC login process.
-A user connecting with this backend will only be able to access the `/o/authorize/` URL.
-
-### The OIDC validators
-
-There are two validators available:
-
- - `BaseValidator`: This validator retrieves simple claims
- - `ProConnectValidator`: This validator is a custom validator to allow ProConnect specific requirements.
-
-
-## Configuration
-
-The keycloak configuration is not described here, but you may find information in the code base.
-
-### Django settings
-
-The following settings are required to enable the OIDC Identity Provider feature:
-
- - OAUTH2_PROVIDER_OIDC_ENABLED: True
- - OAUTH2_PROVIDER_OIDC_RSA_PRIVATE_KEY: ...
-
-Optional:
-
- - OAUTH2_PROVIDER_VALIDATOR_CLASS: "mailbox_oauth2.validators.ProConnectValidator"
-
-If the `OAUTH2_PROVIDER_VALIDATOR_CLASS` is set to the `ProConnectValidator`, the claims will be
-automatically defined to match the ProConnect requirements.
-
-### Django OIDC application
-
-To enable an OIDC client to use people, you must declare it.
-
-```python
-from oauth2_provider.models import Application
-
-application = Application(
-    client_id="people-idp",
-    client_secret="local-tests-only",
-    client_type=Application.CLIENT_CONFIDENTIAL,
-    authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
-    name="People Identity Provider",
-    algorithm=Application.RS256_ALGORITHM,
-    redirect_uris="http://localhost:8083/realms/people/broker/oidc-people-local/endpoint",
-    skip_authorization=True,
-)
-application.clean()
-application.save()
-```
-
-## Security concerns
-
-### Failed login cooldown
-
-To prevent brute force attacks, 5 failed login will trigger a cooldown of 5 minutes before being able to log in again.
-
-### Password strength
-
-There is currently no constraint on the password strength as it can only be defined by Django administrators,
-and later we will generate it.
-If at some point the user is allowed to set their password, we will need to enforce a password strength policy.
-
-
-## What is missing (next steps)
-
-- `Mailbox` password can only be set through Django Admin panel (or shell), the next step will be to generate 
-  a secure password and send it or display it to the end user.
-- `MailboxDomain` organization can only be set through Django Admin panel (or shell), we need to provide a
-  way to auto-select it or allow an administrator to do so.

docs/interoperability/dimail.md

@@ -1,50 +0,0 @@
-# dimail 
-
-## What is dimail ? 
-
-The mailing solution provided in La Suite is [La Messagerie](https://webmail.numerique.gouv.fr/), using [Open-XChange](https://www.open-xchange.com/) (OX). OX not having a provisioning API, 'dimail-api' or 'dimail' was created to allow mail-provisioning through People.
-
-API and its documentation can be found [here](https://api.dev.ox.numerique.gouv.fr/docs#/).
-
-## Use of dimail container
-
-To ease local development, dimail provides a container that we embark in our docker-compose. In "FAKE" mode, it simulates all responses from Open Exchange.
-
-Bootstraping with command `make bootstrap` creates a container and initializes its database.
-
-Additional commands : 
-- Reset and populate the database with all the content of your People database with `dimail-setup-db`
-
-## Architecture
-
-### Domains
-
-Upon creating a domain on People, the same domain is created on dimail and will undergo a series of checks. When all checks have passed, the domain is considered enabled. 
-
-Domains in OX have a field called "context". "Contexts" are shared spaces between domains, allowing users to discover users not only on their domain but on their entire context.
-> [!NOTE]   
-> Contexts are only implemented in La Messagerie and are not currently in use in People. Domains created via People are in their own context.
-
-People users can have 3 levels of permissions on a domain:
-- Viewers can
-    - see the domain's information
-    - list its mailboxes and managers
-- Administrators can
-    - create mailboxes
-    - invite collaborators to manage domain
-    - change role of a viewer to administrators
-    - all of viewers permissions
-- Owners can
-    - promote administrators owners and demote owners
-    - all of viewers and administrators' permissions
-> [!NOTE]   
-> Contexts are only implemented in La Messagerie and are not currently in use in People. Domains created via People are in their own context.
-
-
-### Mailboxes 
-
-Mailboxes can be created by a domain owners or administrators in People's domain tab.
-
-On enabled domains, mailboxes are created at the same time on dimail (and a confirmation email is sent to the secondary email).
-On pending/failed domains, mailboxes are only created locally with "pending" status and are sent to dimail upon domain's (re)activation.
-On disabled domains, mailboxes creation is not allowed.

docs/local_development_kube.md

@@ -1,75 +0,0 @@
-# Local development with Kubernetes
-
-We use tilt to provide a local development environment for Kubernetes. 
-Tilt is a tool that helps you develop applications for Kubernetes. 
-It watches your files for changes, rebuilds your containers, and restarts your pods. 
-It's like having a conversation with your cluster.
-
-This is particularly useful when working on integrations or to test your helm charts.
-Otherwise, you can use your good old docker configuration as described in README.md. 
-
-## Prerequisites
-
-This guide assumes you have the following tools installed:
-
-- [Docker](https://docs.docker.com/get-docker/)
-- [Kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
-- [Kind](https://kind.sigs.k8s.io/docs/user/quick-start/)
-  * [mkcert](https://github.com/FiloSottile/mkcert)
-- [ctlptl](https://github.com/tilt-dev/ctlptl)
-- [Tilt](https://docs.tilt.dev/install.html)
-  * [helm](https://helm.sh/docs/intro/install/)
-  * [helmfile](https://github.com/helmfile/helmfile)
-  * [secrets](https://github.com/jkroepke/helm-secrets/wiki/Installation)
-
-[Install_prereq script](https://github.com/numerique-gouv/dk8s/blob/main/scripts/install-prereq.sh) (not tested).
-
-### Helmfile in Docker
-
-```bash
-#!/bin/sh
-
-docker run --rm --net=host \
-   -v "${HOME}/.kube:/root/.kube" \
-   -v "${HOME}/.config/helm:/root/.config/helm" \
-   -v "${HOME}/.minikube:/${HOME}/.minikube" \
-   -v "${PWD}:/wd" \
-   -e KUBECONFIG=/root/.kube/config \
-   --workdir /wd ghcr.io/helmfile/helmfile:v0.150.0 helmfile "$@"
-```
-
-## Create the kubernetes cluster
-
-Run the following command to create a kubernetes cluster using kind:
-
-```bash
-make start-kind
-
-# import your secrets from credentials manager
-# ! don't forget "https" before your url
-make install-external-secrets
-```
-
-That's it! You should now have a local development environment for Kubernetes.
-
-## Start the application
-
-```bash
-# You can either start :
-# ProConnect stack (but secrets must be set on your local cluster)
-make tilt-up
-
-# or standalone environment with keycloak
-make start-tilt-keycloak
-```
-
-Access your application at https://desk.127.0.0.1.nip.io 
-
-## Management
-
-To manage the cluster, you can use k9s.
-
-## Next steps
-
-- Add dimail to the local development environment
-- Add a reset demo `cmd_button` to Tilt

docs/models.md

@@ -6,56 +6,16 @@ interact efficiently.
 
 Let's see how we could interact with Django's shell to recreate David's environment in the app.
 
-## Profile contact
+## Base contacts from the organization records
 
-The system identifies Dave through the `sub` associated with his OIDC session.
-The OIDC should also provide his email address.
-
-Note: as some Identity Providers do not provide a constant `sub`, the system should be able to
-fallback to the email address to find it the user is already in the database.
-
-When Dave logs in for the first time, the system checks if he is already in the database. If not
-a new user is created for him.
-
-Users needs to be linked to an Organization (see [organizations.md](./organizations.md)).
+David Bowman is an exemplary employee at Space Odyssey Corporation. His email is
+`david.bowman@spaceodyssey.com` and he is registered in the organization's records via a base
+contact as follows:
 
 ```python
-space_odyssey, _created = Organization.objects.get_or_create(...)
-
-david_user = User.objects.create(
-    organization=space_odyssey,
-    language="en-us",
-    timezone="America/Los_Angeles",
-    name="David Bowman",
-    sub="1234567890",
-    email="david.bowman@spaceodyssey.com",
-)
-```
-
-The system then creates a profile contact for Dave, based on the information provided by the OIDC:
-
-```python
-david_profile_contact = Contact.objects.create(
-    owner=david_user,
-    user=david_user,  # this means it's the user's profile contact
+david_base_contact = Contact.objects.create(
     full_name="David Bowman",
-    data={
-        "emails": [
-            {"type": "Work", "value": "david.bowman@spaceodyssey.com"},
-        ],
-    },
-)
-```
-
-**Future feature:**
-Dave will be prompted to confirm the details of the base contact stored in the database
-and fill the details for a better profile.
-
-His profile contact will be updated with the new information.
-
-```python
-Contact.objects.filter(user=david_user, owner=david_user).update(
-    short_name="Dave",
+    short_name="David",
     data={
         "emails": [
             {"type": "Work", "value": "david.bowman@spaceodyssey.com"},
@@ -88,81 +48,91 @@ Contact.objects.filter(user=david_user, owner=david_user).update(
 )
 ```
 
-David's profile contact is available to all users of his company/organization.
+When David logs-in to the People application for the first time using the corporation's OIDC
+Single Sign-On service. A user is created for him on the fly by the system, together with an
+identity record representing the OIDC session:
 
+```python
+david_user = User.objects.create(
+    language="en-us",
+    timezone="America/Los_Angeles",
+)
+david_identity = Identity.objects.create(
+  "user": david_user,
+  "sub": "2a1b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
+  "email" : "david.bowman@spaceodyssey.com",
+  "is_main": True,
+)
+```
+
+## Profile contact
+
+The system identifies Dave through the email associated with his OIDC session and prompts him to
+confirm the details of the base contact stored in the database.
+
+When David confirms, giving an alternative short name that he prefers, a contact override is
+created on top of the organization's base contact. This new contact is marked as David's profile
+on the user:
+
+```python
+david_contact = Contact.objects.create(
+    base=david_base_contact,
+    owner=david_user,
+    full_name="David Bowman",
+    short_name="Dave",
+    data={}
+)
+david_user.profile_contact = david_contact
+david_user.save()
+```
+
+If Dave had not had any existing contact in the organization's records, the profile contact would
+have been created independently, without any connection to a base contact:
+
+```python
+david_contact = Contact.objects.create(
+    base=None,
+    owner=david_user,
+    full_name="David Bowman",
+    short_name="Dave",
+    data={}
+)
+```
+
+Now, Dave feels like sharing his mobile phone number with his colleagues. He can do this
+by editing his contact in the application:
+
+```python
+contact.data["phones"] = [
+    {"type": "Mobile", "value": "(123) 456-7890"},
+]
+contact.save()
+```
 
 ## Contact override
 
 During a Space conference he attended, Dave met Dr Ryan Stone, a medical engineer who gave him
-her personal email address (because she will quit the company she works for). Ryan is already 
-present in the system.
-
+her professional email address. Ryan is already present in the system but her email is missing.
 Dave can add it to his private version of the contact:
 
 ```python
-ryan_user = User.objects.create(
-    organization=space_odyssey,
-    language="en-us",
-    timezone="America/Los_Angeles",
-    name="Ryan Stone",
-    sub="0987654321",
-    email="ryan.stone@spaceodyssey.com",
+ryan_base_contact = Contact.objects.create(
+    full_name="Ryan Stone",
+    data={}
 )
-
-ryan_profile_contact = Contact.objects.create(
-    user=ryan_user,
-    owner=ryan_user,
+ryan_contact = Contact.objects.create(
+    base=ryan_base_contact,
+    owner=david_user,
     full_name="Ryan Stone",
     short_name="Dr Ryan",
     data={
         "emails": [
             {"type": "Work", "value": "ryan.stone@hubblestation.com"},
         ],
-    },
-)
-
-david_ryan_contact = Contact.objects.create(
-    override=ryan_profile_contact,
-    owner=david_user,
-    full_name="Ryan Stone",
-    short_name="Dr Ryan",
-    data={
-        "emails": [
-            {"type": "Home", "value": "ryan@stone.com"},
-        ],
-    },
+    }
 )
 ```
 
-## Personal contacts
-
-Dave met a lot of people during the last Opensource Experience event. He can add them to his personal contacts:
-
-```python
-julie_personal_contact = Contact.objects.create(
-    owner=david_user,
-    full_name="Julie Powell",
-    short_name="Julie",
-    data={
-        "emails": [
-            {"type": "Work", "value": "julie.powell@example.com"},
-        ],
-        "phones": [
-            {"type": "Work", "value": "(123) 456-7890"},
-        ],
-    },
-)
-```
-
-These contacts are only available to Dave.
-
-
-## Contacts from shared directories
-
-This is a future feature that will allow Dave to access contacts from shared directories.
-Shared directories will provide contacts for all users from several organizations.
-
-
 ## Team Collaboration
 
 Dave wants to form a team with Ryan and other colleagues to work together better on using the organization's digital tools for their projects.

docs/organizations.md

@@ -1,41 +0,0 @@
-# Organization model
-
-## Purpose
-
-The initial `Organization` model allows to regroup `User` and `Team` under a same object.
-
-While the purpose was purely technical in the first place, few features emerged afterward.
-
-
-## Link with the `User` model
-
-Each user must have a "default" organization. 
-
-When a user logs in:
-
-- The backend tries to get an existing organization from a "registration ID" or from the user's mail domain
-- If the organization does not exist, it is created using the "registration ID" and fallbacks on the user's mail domain
-- The user organization is set to this organization.
-
-**Note:** While deploying the new code, we allow the already existing user to not have one.
-
-
-## Link with the `Team` model
-
-Each team must have an organization. This organization is not defined by the user, but automatically set
-using the user's organization.
-
-The team's organization does not restrict the users who can be added to the team.
-
-There is currently no feature relying on the team organization.
-
-**Note:** While deploying the new code, we allow the teams to not have one.
-
-
-## Organization-related features
-
-### Organization UI
-
-A new interface can be created to allow users to see all members of an organization. 
-This could be used along with the contacts.
-

docs/release.md

@@ -1,68 +0,0 @@
-# Releasing a new version
-
-Whenever we are cooking a new release (e.g. `4.18.1`) we should follow a standard procedure described below:
-
-1.  Checkout and pull changes from the `main` branch to ensure you have the latest updates.
-
-    ```bash
-    git checkout main
-    git pull
-    ```
-
-2.  The next steps are automated in the `scripts/release.py`, you can run it using:
-
-    ```bash
-    make release
-    ```
-
-    This script will ask you for the version you want to release and the kind of release (patch, minor, major). It will then:
-
-    - Create a new branch named: `release/4.18.1`.
-
-    - Bump the release number for backend and frontend project.
-
-    - Update the project's `Changelog` following the [keepachangelog](https://keepachangelog.com/en/0.3.0/) recommendations
-
-    - Commit your changes with the following format: 🔖 release emoji, type of release (patch/minor/patch) and release version:
-    
-        ```text
-        🔖(minor) release version 4.18.1
-        ```
-
-    - Triggers Crowdin translation action and open related PR
-
-    - Open release PR. Wait for an approval from your peers and merge it.
-
-    > [!NOTE]  
-    > It also open the PR for pre-prod deployment, see following section.
-
-3.  Following release script instructions, 
-
-    - merge translation and release pulls requests
-
-    - tag and push your commit:
-
-    ```bash
-    git tag v4.18.1 && git push origin tag v4.18.1
-    ```
-
-    This triggers the CI building new Docker images. You can ensure images were successfully built on Docker Hub [here for back-end](https://hub.docker.com/r/lasuite/people-backend/tags) and [here for front-end](https://hub.docker.com/r/lasuite/people-frontend/tags).
-
-
-# Deploying 
-
-## Staging
-
-The `staging` platform is deployed automatically with every update of the `main` branch.
-
-## Pre-prod and production
-
-If you used the release script and had permission to push on [lasuite-deploiement](https://github.com/numerique-gouv/lasuite-deploiement), a deployment branch has been created. You can skip step 1.
-
-Otherwise, for manual preprod and for production deployments :
-1. Bump tag version for both front-end and back-end images in the `.gotmpl` file located in `manifests/<your-product>/env.d/<your-environment>/`, 
-2. Add optional new secrets and variables, if applicable
-3. Create a pull request
-4. Submit to approval and merge PR
-
-The release is now done! 🎉

docs/resourceServer.md

@@ -1,164 +0,0 @@
-## Resource Server
-
-For detailed information, please refer to the [OAuth 2.0 Resource Server documentation](https://www.oauth.com/oauth2-servers/the-resource-server/) and review the relevant commits that implement the resource server backend.
-
----
-#### Overview
-
-A resource server is a crucial component in an OAuth 2.0 ecosystem. It is responsible for accepting access tokens issued by the authorization server (in this case, Agent Connect), introspecting and validating those tokens, and then returning the requested protected resources to the client.
-
-By implementing a resource server, we can securely share data between different services within La Suite. This ensures that only clients with the appropriate scopes and permissions can access specific resources, thereby enhancing security and maintaining proper access control across services.
-
----
-#### Disclaimer
-
-- Currently compatible only with Agent Connect.
-- The development setup requires simplification, with dependencies on Agent Connect ideally mocked.
-- Terminology aligns with the specification: what is referred to as a "resource server" is known as a "data provider" in Agent Connect.
-- This documentation is WIP.
-
----
-## Running Locally
-
-#### Prerequisites
-
-- **Agent Connect Stack**: Ensure the local Agent Connect stack is running. A solid understanding of its configuration and operation is recommended (advanced level).
-- **People Stack**: Make sure the People stack is up and running.
-- **Ngrok**: Install and set up Ngrok for secure tunneling.
-
-
----
-
-### Update People's configurations
-
-#### Environment variables
-
-
-Agent Connect includes two pre-configured mocked data providers in its default stack (`bdd-fca-low`).
-
-Use the client ID and client secret from one of these data providers. **Note:** Make sure to retrieve the decrypted secret, as it is stored encrypted in the database. You can find these values in the `dp.js` fixture file, where they are exposed in a comment.
-
-Configure your environment with the following values from Agent Connect:
-
-```
-OIDC_RS_CLIENT_ID=<your-client-id-from-ac>
-OIDC_RS_CLIENT_SECRET=<your-decrypted-client-secret-from-ac>
-
-# In development, the resource server use insecure settings
-OIDC_VERIFY_SSL=False
-
-# Update the endpoints as follows
-OIDC_OP_JWKS_ENDPOINT=https://core-fca-low.docker.dev-franceconnect.fr/api/v2/jwks
-OIDC_OP_INTROSPECTION_ENDPOINT=https://core-fca-low.docker.dev-franceconnect.fr/api/v2/checktoken
-OIDC_OP_URL=https://core-fca-low.docker.dev-franceconnect.fr/api/v2
-```
-
-#### Docker Network Configuration
-
-To enable communication between the Docker networks for People and Agent Connect, update your docker-compose configuration. This setup is required because the Authorization Server and Resource Server will exchange requests over a back-channel, necessitating their accessibility to each other.
-
-1. **Create a Network**: Define a new network to bridge the two Docker networks.
-
-    ```yaml
-    networks:
-      authorization_server:
-        external: true
-        driver: bridge
-        name: "${DESK_NETWORK:-fc_public}"
-    ```
-
-2. **Update Network for `app-dev`**: Ensure your `app-dev` service is connected to both the default network and the new `authorization_server` network.
-
-    ```yaml
-    app-dev:
-      ...
-      networks:
-        - default
-        - authorization_server
-    ```
-
-
-#### Ngrok
-
-To expose your local resource server through an HTTP tunnel, use Ngrok. This is necessary because, in the Agent Connect development stack, the resource server needs to be accessible to a user agent via a publicly accessible URL.
-
-```
-$ ngrok http 8071
-```
-
----
-
-
-### Update AgentConnect's configurations
-
-Modify the AgentConnect configuration to include the local resource server settings.
-
-**Update `fsa1-low` Environment File**:
-
-Add your Ngrok URL and configure the `DATA_APIS` list with the appropriate values.
-
- ```env
- App_DATA_APIS=[{"name":"Data Provider 1","url":"https://your-ngrok-url/api/v1.0/any-path","secret":"***"}, ...]
- ```
-
-**Update Fixture in `dp.js`**:
-
-Adjust the configuration for the data provider to match your local setup. Ensure that the `client_id`, `client_secret`, and other parameters are correctly set and aligned with your environment. This can be configured through environment variables.
-
- ```javascript
- const dps = [
-   // Data Provider Configuration
-   {
-     uid: "6f21b751-ed06-48b6-a59c-36e1300a368a",
-     title: "Mock Data Provider - 1",
-     active: true,
-     slug: "DESK",
-     client_id: "***",
-     client_secret: "***",
-       // client_secret decrypted : ****
-     jwks_uri: "https://your-ngrok-url/api/v1.0/jwks", // Update this line
-     checktoken_signed_response_alg: "ES256",
-     checktoken_encrypted_response_alg: "RSA-OAEP",
-     checktoken_encrypted_response_enc: "A256GCM",
-   },
- ];
- ```
-
-**Note**: Ensure that the `jwks_uri` and other cryptographic parameters (e.g., `checktoken_signed_response_alg`, `checktoken_encrypted_response_alg`, and `checktoken_encrypted_response_enc`) match your actual setup and are configured via environment variables where necessary.
-
----
-
-### Usage
-
-This section is a work in progress. Please note the following important points:
-
-#### User `sub` Matching
-
-Ensure that the `sub` (subject) field for users in AgentConnect matches the corresponding value in the People database. To synchronize this, you can run `make demo`, then edit the user's `sub` field to match the value returned by AgentConnect. For this, you'll need to update the editable field in Django Admin, specifically in `admin.py`. Adjust the `get_readonly_fields` method as follows:
-
-```python
-def get_readonly_fields(self, request, obj=None):
-    """The 'sub' field should only be editable during creation, not for updates."""
-    if obj:
-        return self.readonly_fields
-    return self.readonly_fields + ["sub"]  # update this line adding 'sub'
-```
-
-#### Scope for `groups`
-Ensure that the `groups` scope is requested from the service provider during authentication with AgentConnect.
-
-#### Resource Server Requests
-By default, the `fsa1-low` environment calls the resource server using a POST request.
-
-#### Testing
-
-Most of the testing has been done using the `/users/me` endpoint. Update the `api/viewset.py` configuration to allow both GET and POST methods for this endpoint:
-
-```python
-@decorators.action(
-    detail=False,
-    methods=["get", "post"], # update this line adding 'post'
-    url_name="me",
-    url_path="me",
-)
-```

docs/serviceProviders.md

@@ -1,28 +0,0 @@
-# ServiceProvider model
-
-## Purpose
-
-The `ServiceProvider` model represents a ... service provider, also known as "tools using some data from this project".
-
-
-## Link with the `Organization` model
-
-An organization can be linked to several service providers. 
-The goal here, is to allow users of an organization to have access, to a service provider or not.
-The first implementation does not have any feature related, but the first feature will probably be
-to list applications visible in the "all application menu" (aka "la gaufre").
-
-
-## Link with the `Team` model
-
-A team can be linked to several service providers.
-This is used as a filter when a service provider calls the resource server, only the teams linked to
-this service provider are returned. This is mandatory for data segregation: we don't want all service
-providers to be able to list all data regarding other service providers.
-
-
-## Limitations
-
-There is currently no way to provision all the service providers automatically. So when a service provider
-creates a team via the resource server, we create the `ServiceProvider` on the fly, without any understandable name.
-This will need to be improved later.

docs/testsE2E.md

@@ -1,51 +0,0 @@
-# E2E tests
-
-## Run E2E tests
-
-``` bash
-# you need the dockers to be up and running
-make bootstrap
-
-# you will need to have few accounts in the database
-make demo FLUSH_ARGS='--no-input'
-
-# run the tests
-cd src/frontend/apps/e2e
-yarn test:ui --workers=1
-```
-
-A new browser window will open and you will be able to run the tests.
-
-## Available accounts
-
-The `make demo` command creates the following accounts:
- - `e2e.team-<role>@example.com` where `<role>` is one of `administrator`, `member`, `owner`:
-    this account only belong to a team with the specified role.
- - `e2e.mail-<role>@example.com` where `<role>` is one of `administrator`, `member`, `owner`:
-    this account only have a mailbox with the specified role access.
- - `e2e.team-<team_role>-mail-<domain_role>@example.com` with a combination of roles as for the
-    previous accounts.
-
-For each account, the password is `password-e2e.<role>`, for instance `password-e2e.team-member`.
-
-In the E2E tests you can use these accounts to benefit from there accesses, 
-using the `keyCloakSignIn(page, browserName, <account_name>)`. The account name is the 
-username without the prefix `e2e.`.
-
-``` typescript jsx
-await keyCloakSignIn(page, browserName, 'mail-owner');
-```
-
-The `keyCloakSignIn` function will sign in the user on Keycloak using the proper username and password.
-
-.. note::
-    This only works because the OIDC setting is set to fallback on user email.
-
-## Add a new account
-
-In case you need to add a new account for specific tests you need:
-- to create a new user with the same format in the backend database: 
-  update `[create_demo.py](../src/backend/demo/management/commands/create_demo.py)`
-- to create a new account in Keycloak: update [realm.json](../docker/auth/realm.json)
-- if the keycloak was running locally, you need to destroy its database and 
-  restart the database and the keycloak containers.

env.d/development/common.dist

@@ -3,7 +3,6 @@ DJANGO_ALLOWED_HOSTS=*
 DJANGO_SECRET_KEY=ThisIsAnExampleKeyForDevPurposeOnly
 DJANGO_SETTINGS_MODULE=people.settings
 DJANGO_SUPERUSER_PASSWORD=admin
-DJANGO_CORS_ALLOWED_ORIGINS=http://localhost:3000
 
 # Python
 PYTHONPATH=/app
@@ -11,7 +10,7 @@ PYTHONPATH=/app
 # People settings
 
 # Mail
-DJANGO_EMAIL_HOST="maildev"
+DJANGO_EMAIL_HOST="mailcatcher"
 DJANGO_EMAIL_PORT=1025
 
 # Backend url
@@ -34,38 +33,3 @@ LOGOUT_REDIRECT_URL=http://localhost:3000
 
 OIDC_REDIRECT_ALLOWED_HOSTS=["http://localhost:8083", "http://localhost:3000"]
 OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
-
-OIDC_RS_CLIENT_ID=people
-OIDC_RS_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
-OIDC_RS_PRIVATE_KEY_STR="-----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC3boG1kwEGUYL+
-U58RPrVToIsF9jHB64S6WJIIInPmAclBciXFb6BWG11mbRIgo8ha3WVnC/tGHbXb
-ndiKdrH2vKHOsDhV9AmgHgNgWaUK9L0uuKEb/xMLePYWsYlgzcQJx8RZY7RQyWqE
-20WfzFxeuCE7QMb6VXSOgwQMnJsKocguIh3VCI9RIBq3B1kdgW35AD63YKOygmGx
-qjcWwbjhKLvkF7LpBdlyAEzOKqg4T5uCcHMfksMW2+foTJx70RrZM/KHU+Zysuw7
-uhhVsgPBG+CsqBSjHQhs7jzymqxtQAfe1FkrCRxOq5Pv2Efr7kgtVSkJJiX3KutM
-vnWuEypxAgMBAAECggEAGqKS9pbrN+vnmb7yMsqYgVVnQn0aggZNHlLkl4ZLLnuV
-aemlhur7zO0JzajqUC+AFQOfaQxiFu8S/FoJ+qccFdATrcPEVmTKbgPVqSyzLKlX
-fByGll5eOVT95NMwN8yBGgt2HSW/ZditXS/KxxahVgamGqjAC9MTSutGz/8Ae1U+
-DNDBJCc6RAqu3T02tV9A2pSpVC1rSktDMpLUTscnsfxpaEQATd9DJUcHEvIwoX8q
-GJpycPEhNhdPXqpln5SoMHcf/zS5ssF/Mce0lJJXYyE0LnEk9X12jMWyBqmLqXUY
-cKLyynaFbis0DpQppwKx2y8GpL76k+Ci4dOHIvFknQKBgQDj/2WRMcWOvfBrggzj
-FHpcme2gSo5A5c0CVyI+Xkf1Zab6UR6T7GiImEoj9tq0+o2WEix9rwoypgMBq8rz
-/rrJAPSZjgv6z71k4EnO2FIB5R03vQmoBRCN8VlgvLM0xv52zyjV4Wx66Q4MDjyH
-EgkpHyB0FzRZh0UzhnE/pYSetQKBgQDN9eLB1nA4CBSr1vMGNfQyfBQl3vpO9EP4
-VSS3KnUqCIjJeLu682Ylu7SFxcJAfzUpy5S43hEvcuJsagsVKfmCAGcYZs9/xq3I
-vzYyhaEOS5ezNxLSh4+yCNBPlmrmDyoazag0t8H8YQFBN6BVcxbATHqdWGUhIhYN
-eEpEMOh2TQKBgGBr7kRNTENlyHtu8IxIaMcowfn8DdUcWmsW9oBx1vTNHKTYEZp1
-bG/4F8LF7xCCtcY1wWMV17Y7xyG5yYcOv2eqY8dc72wO1wYGZLB5g5URlB2ycJcC
-LVIaM7ZZl2BGl+8fBSIOx5XjYfFvQ+HLmtwtMchm19jVAEseHF7SXRfRAoGAK15j
-aT2mU6Yf9C9G7T/fM+I8u9zACHAW/+ut14PxN/CkHQh3P16RW9CyqpiB1uLyZuKf
-Zm4cYElotDuAKey0xVMgYlsDxnwni+X3m5vX1hLE1s/5/qrc7zg75QZfbCI1U3+K
-s88d4e7rPLhh4pxhZgy0pP1ADkIHMr7ppIJH8OECgYEApNfbgsJVPAMzucUhJoJZ
-OmZHbyCtJvs4b+zxnmhmSbopifNCgS4zjXH9qC7tsUph1WE6L2KXvtApHGD5H4GQ
-IH5em4M/pHIcsqCi1qggBMbdvzHBUtC3R4sK0CpEFHlN+Y59aGazidcN2FPupNJv
-MbyqKyC6DAzv4jEEhHaN7oY=
------END PRIVATE KEY-----
-"
-
-# INTEROP
-MAIL_PROVISIONING_API_CREDENTIALS="bGFfcmVnaWU6cGFzc3dvcmQ=" # Dev and test key for dimail interop

env.d/development/common.e2e.dist

@@ -1,10 +1,3 @@
 # For the CI job test-e2e
 SUSTAINED_THROTTLE_RATES="200/hour"
 BURST_THROTTLE_RATES="200/minute"
-
-OIDC_ORGANIZATION_REGISTRATION_ID_FIELD="siret"
-
-OAUTH2_PROVIDER_OIDC_ENABLED=True
-OAUTH2_PROVIDER_VALIDATOR_CLASS="mailbox_oauth2.validators.ProConnectValidator"
-
-INSTALLED_PLUGINS=plugins.la_suite

env.d/development/france.dist

@@ -1 +0,0 @@
-INSTALLED_PLUGINS=plugins.la_suite

env.d/development/kc_postgresql.dist

@@ -8,4 +8,4 @@ DB_HOST=kc_postgresql
 DB_NAME=keycloak
 DB_USER=people
 DB_PASSWORD=pass
-DB_PORT=5433
+DB_PORT=5433

env.d/development/postgresql.dist

@@ -8,4 +8,4 @@ DB_HOST=postgresql
 DB_NAME=people
 DB_USER=dinum
 DB_PASSWORD=pass
-DB_PORT=5432
+DB_PORT=5432

renovate.json

@@ -1,7 +1,6 @@
 {
   "extends": ["github>numerique-gouv/renovate-configuration"],
   "dependencyDashboard": true,
-  "labels": ["dependencies", "noChangeLog"],
   "packageRules": [
     {
       "enabled": false,
@@ -13,12 +12,21 @@
       "enabled": false,
       "groupName": "ignored js dependencies",
       "matchManagers": ["npm"],
-      "matchPackageNames": ["fetch-mock", "node", "node-fetch", "eslint", "@hookform/resolvers"]
+      "matchPackageNames": ["node", "node-fetch", "i18next-parser"]
     },
     {
-      "groupName": "docker-compose dependencies",
-      "matchManagers": ["docker-compose"],
-      "matchPackageNames": ["dimail-api"]
+      "enabled": false,
+      "groupName": "ignored js @types/react-dom@18.2.19",
+      "matchManagers": ["npm"],
+      "matchPackageNames": ["@types/react-dom"],
+      "allowedVersions": ">18.2.19"
+    },
+    {
+      "enabled": false,
+      "groupName": "ignored js @openfun/cunningham-react@2.5.0",
+      "matchManagers": ["npm"],
+      "matchPackageNames": ["@openfun/cunningham-react"],
+      "allowedVersions": ">2.5.0"
     }
   ]
 }

scripts/install-pre-commit-hook.sh

@@ -1,10 +1,10 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
 mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
 PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"
 
 cat <<'EOF' >$PRE_COMMIT_FILE
-#!/usr/bin/env bash
+#!/bin/bash
 
 # directories containing potential secrets
 DIRS="."

scripts/keycloak/add-keycloak-client.sh

@@ -1,149 +0,0 @@
-#!/bin/bash
-
-# Script to add a new client to Keycloak using the kcadm.sh CLI
-# Usage: ./add-keycloak-client.sh [client_id] [client_secret]
-
-# Default values
-CLIENT_ID=${1:-"some-client-id"}
-CLIENT_SECRET=${2:-"ThisIsAnExampleKeyForDevPurposeOnly"}
-KEYCLOAK_URL=${KEYCLOAK_URL:-"http://keycloak:8080"}
-KEYCLOAK_ADMIN=${KEYCLOAK_ADMIN:-"admin"}
-KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD:-"admin"}
-REALM=${REALM:-"people"}
-
-# Check for kcadm.sh in common locations
-KCADM_LOCATIONS=(
-  "/opt/keycloak/bin/kcadm.sh"
-  "/opt/jboss/keycloak/bin/kcadm.sh"
-  "/usr/local/bin/kcadm.sh"
-  "./bin/kcadm.sh"
-  "$(which kcadm.sh 2>/dev/null)"
-)
-
-KCADM=""
-for loc in "${KCADM_LOCATIONS[@]}"; do
-  if [ -x "$loc" ]; then
-    KCADM="$loc"
-    break
-  fi
-done
-
-if [ -z "$KCADM" ]; then
-  echo "Error: kcadm.sh not found. Please specify its location manually."
-  echo "You can set the KCADM environment variable to the path of kcadm.sh"
-  exit 1
-fi
-
-echo "Using Keycloak Admin CLI at: $KCADM"
-echo "Logging in to Keycloak at $KEYCLOAK_URL..."
-
-# Login to Keycloak
-$KCADM config credentials \
-  --server $KEYCLOAK_URL \
-  --realm master \
-  --user $KEYCLOAK_ADMIN \
-  --password $KEYCLOAK_ADMIN_PASSWORD
-
-if [ $? -ne 0 ]; then
-  echo "Failed to login to Keycloak. Please check your credentials and try again."
-  exit 1
-fi
-
-echo "Successfully logged in to Keycloak."
-echo "Creating new client '$CLIENT_ID' in realm '$REALM'..."
-
-# Create a temporary JSON file with client configuration
-CLIENT_JSON=$(mktemp)
-cat > "$CLIENT_JSON" << EOF
-{
-  "clientId": "$CLIENT_ID",
-  "name": "",
-  "description": "",
-  "rootUrl": "",
-  "adminUrl": "",
-  "baseUrl": "",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "secret": "$CLIENT_SECRET",
-  "redirectUris": [
-    "http://localhost:8070/*",
-    "http://localhost:8071/*",
-    "http://localhost:3200/*",
-    "http://localhost:8088/*",
-    "http://localhost:3000/*"
-  ],
-  "webOrigins": [
-    "http://localhost:3200",
-    "http://localhost:8088",
-    "http://localhost:8070",
-    "http://localhost:3000"
-  ],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": false,
-  "serviceAccountsEnabled": false,
-  "publicClient": false,
-  "frontchannelLogout": true,
-  "protocol": "openid-connect",
-  "attributes": {
-    "access.token.lifespan": "-1",
-    "client.secret.creation.time": "$(date +%s)",
-    "user.info.response.signature.alg": "RS256",
-    "post.logout.redirect.uris": "http://localhost:8070/*##http://localhost:3200/*##http://localhost:3000/*",
-    "oauth2.device.authorization.grant.enabled": "false",
-    "use.jwks.url": "false",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "use.refresh.tokens": "true",
-    "tls-client-certificate-bound-access-tokens": "false",
-    "oidc.ciba.grant.enabled": "false",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "acr.loa.map": "{}",
-    "require.pushed.authorization.requests": "false",
-    "display.on.consent.screen": "false",
-    "client.session.idle.timeout": "-1",
-    "token.response.type.bearer.lower-case": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "acr",
-    "roles",
-    "profile",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ]
-}
-EOF
-
-# Create the client using kcadm.sh
-$KCADM create clients -r "$REALM" -f "$CLIENT_JSON"
-
-if [ $? -ne 0 ]; then
-  echo "Failed to create client. Check the error message above."
-  rm "$CLIENT_JSON"
-  exit 1
-fi
-
-echo "✅ Client '$CLIENT_ID' created successfully!"
-echo "  Client ID: $CLIENT_ID"
-echo "  Client Secret: $CLIENT_SECRET"
-
-# Clean up temporary file
-rm "$CLIENT_JSON"
-
-# Display the created client
-echo "Client details:"
-$KCADM get clients -r "$REALM" --query "clientId=$CLIENT_ID"

scripts/release.py

@@ -1,166 +0,0 @@
-# pylint: disable=line-too-long
-
-import datetime
-import os
-import re
-import sys
-
-from utils import run_command
-
-
-RELEASE_KINDS = {'p': 'patch', 'm': 'minor', 'mj': 'major'}
-
-
-def update_files(version):
-    """Update all files needed with new release version"""
-    # pyproject.toml
-    sys.stdout.write("Update pyproject.toml...\n")
-    path = "src/backend/pyproject.toml"
-    with open(path, 'r') as file:
-        lines = file.readlines()
-        for index, line in enumerate(lines):
-            if line.startswith("version = "):
-                lines[index] = re.sub(r'\"(.*?)\"', f'"{version}"', line)
-    with open(path, 'w+') as file:
-        file.writelines(lines)
-
-    # frontend package.json
-    sys.stdout.write("Update package.json...\n")
-    files_to_modify = []
-    filename = "package.json"
-    for root, _dir, files in os.walk("src/frontend"):
-        if filename in files and "node_modules" not in root and ".next" not in root:
-            files_to_modify.append(os.path.join(root, filename))
-
-    for path in files_to_modify:
-        with open(path, 'r') as file:
-            lines = file.readlines()
-            for index, line in enumerate(lines):
-                if "version" in line:
-                    lines[index] = re.sub(r'"version": \"(.*?)\"', f'"version": "{version}"', line)
-        with open(path, 'w+') as file:
-            file.writelines(lines)
-    return
-
-
-def update_helm_files(path):
-    sys.stdout.write("Update helm files...\n")
-    with open(path, 'r') as file:
-        lines = file.readlines()
-        for index, line in enumerate(lines):
-            if "tag:" in line:
-                lines[index] = re.sub(r'\"(.*?)\"', f'"v{version}"', line)
-    with open(path, 'w+') as file:
-        file.writelines(lines)
-
-
-def update_changelog(path, version):
-    """Update changelog file with release info
-    """
-    sys.stdout.write("Update CHANGELOG...\n")
-    with open(path, 'r') as file:
-        lines = file.readlines()
-        for index, line in enumerate(lines):
-            if "## [Unreleased]" in line:
-                today = datetime.date.today()
-                lines.insert(index + 1, f"\n## [{version}] - {today}\n")
-            if line.startswith("[unreleased]"):
-                last_version = lines[index + 1].split("]")[0][1:]
-                new_unreleased_line = line.replace(last_version, version)
-                new_release_line = lines[index + 1].replace(last_version, version)
-                lines[index] = new_unreleased_line
-                lines.insert(index + 1, new_release_line)
-                break
-
-    with open(path, 'w+') as file:
-        file.writelines(lines)
-
-
-def deployment_part(version):
-    """ Update helm file of preprod on deployment repository numerique-gouv/lasuite-deploiement
-    """
-    # Move to lasuite-deploiement repository
-    try:
-        os.chdir('../lasuite-deploiement')
-    except FileNotFoundError:
-        sys.stdout.write("\033[1;31m[Error] You must have a clone of https://github.com/numerique-gouv/lasuite-deploiement\x1b[0m")
-        sys.stdout.write("\033[0;32mPlease clone it and re-run script with option --only-deployment-part\x1b[0m")
-        sys.stdout.write("  >>> python scripts/release.py --only-deployment-part \x1b[0m")
-    else:
-        run_command("git checkout main", shell=True)
-        run_command("git pull", shell=True)
-        deployment_branch = f"regie/{version}/preprod"
-        run_command(f"git checkout -b {deployment_branch}", shell=True)
-        run_command("git pull --rebase origin main", shell=True)
-        path = f"manifests/regie/env.d/preprod/values.desk.yaml.gotmpl"
-        update_helm_files(path)
-        run_command(f"git add {path}", shell=True)
-        message = f"""🔖(regie) bump preprod version to {version}"""
-        run_command(f"git commit -m '{message}'", shell=True)
-        confirm = input(f"""\033[0;32m
-### DEPLOYMENT ###
-NEXT COMMAND on lasuite-deploiement repository: 
-    >> git push origin {deployment_branch}
-Continue ? (y,n) 
-\x1b[0m""").strip()
-        if confirm == 'y':
-            run_command(f"git push origin {deployment_branch}", shell=True)
-        sys.stdout.write(f"""\033[1;34m
-PLEASE DO THE FOLLOWING INSTRUCTIONS: 
---> Check if you need to bump chart version in the manifests/regie/helmfile.yaml file
-    and settings in the manifests/regie/env.d/preprod/values.desk.yaml.gotmpl file
-    add commits into {deployment_branch} branch to do it if needed, then...
---> Please submit PR {deployment_branch} and merge code to main [https://github.com/numerique-gouv/lasuite-deploiement]
-\x1b[0m""")
-
-
-def project_part(version, kind):
-    """Manage only la regie part with update of CHANGELOG, version files and tag"""
-    sys.stdout.write('Let\'s go to create branch to release\n')
-    branch_to_release = f"release/{version}"
-    run_command(f"git checkout -b {branch_to_release}", shell=True)
-    run_command("git pull --rebase origin main", shell=True)
-
-    update_changelog("CHANGELOG.md", version)
-    update_files(version)
-
-    run_command("git add CHANGELOG.md", shell=True)
-    run_command("git add src/", shell=True)
-    message = f"""🔖({RELEASE_KINDS[kind]}) release version {version}
-
-Update all version files and changelog for {RELEASE_KINDS[kind]} release."""
-    run_command(f"git commit -m '{message}'", shell=True)
-    confirm = input(f"""\033[0;32m
-### RELEASE ###
-NEXT COMMAND on current repository:
-    >> git push origin {branch_to_release}
-Continue ? (y,n)
-\x1b[0m""").strip()
-    if confirm == 'y':
-        run_command(f"git push origin {branch_to_release}", shell=True)
-    sys.stdout.write(f"""
-\033[1;34mPLEASE DO THE FOLLOWING INSTRUCTIONS:
---> A github action will download last translations from crowdin and create a PR (i18n/update-translations) to merge into the release branch.
-    Please wait for this, approve and merge this translations PR into the release branch {branch_to_release}.
---> Then please submit PR {branch_to_release} and merge code to main [https://github.com/suitenumerique/people/]
---> Then do:
-    >> git checkout main
-    >> git pull
-    >> git tag v{version} 
-    >> git push origin v{version} 
---> Please check and wait for the docker image v{version} to be published here:
- - https://hub.docker.com/r/lasuite/people-backend/tags 
- - https://hub.docker.com/r/lasuite/people-frontend/tags
---> Now please generate release on github interface for the current tag v{version}
- \x1b[0m""")
-
-
-if __name__ == "__main__":
-    version, kind = None, None
-    while not version:
-        version = input("Enter your release version:").strip()
-    while kind not in RELEASE_KINDS:
-        kind = input("Enter kind of release (p:patch, m:minor, mj:major):").strip()
-    if "--only-deployment-part" not in sys.argv:
-        project_part(version, kind)
-    deployment_part(version)

scripts/update-git-submodule.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-git submodule update --init --recursive
-git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'

scripts/utils.py

@@ -1,14 +0,0 @@
-import subprocess
-import sys
-
-
-def run_command(cmd, msg=None, shell=False, cwd='.', stdout=None):
-    if msg is None:
-        msg = f"# Running: {cmd}"
-    if stdout is not None:
-        stdout.write(msg + '\n')
-        if stdout != sys.stdout:
-            sys.stdout(msg)
-    subprocess.check_call(cmd, shell=shell, cwd=cwd, stdout=stdout, stderr=stdout)
-    if stdout is not None:
-        stdout.flush()

src/backend/.pylintrc

@@ -363,8 +363,7 @@ name-group=
 
 # Regular expression which should only match function or class names that do
 # not require a docstring.
-# Ignore: private stuff and `Params` class from FactoryBoy
-no-docstring-rgx=(^_|^Params$)
+no-docstring-rgx=^_
 
 # List of decorators that produce properties, such as abc.abstractproperty. Add
 # to this list to register other decorators that produce valid properties.

src/backend/__init__.py

@@ -1 +0,0 @@
-"""Root module."""

src/backend/conftest.py

@@ -1,30 +0,0 @@
-"""Global fixtures for the backend tests."""
-
-import pytest
-from urllib3.connectionpool import HTTPConnectionPool
-
-
-@pytest.fixture(autouse=True)
-def no_http_requests(monkeypatch):
-    """
-    Prevents HTTP requests from being made during tests.
-    This is useful for tests that do not require actual HTTP requests
-    and helps to avoid network-related issues.
-
-    Credits: https://blog.jerrycodes.com/no-http-requests/
-    """
-
-    allowed_hosts = {"localhost"}
-    original_urlopen = HTTPConnectionPool.urlopen
-
-    def urlopen_mock(self, method, url, *args, **kwargs):
-        if self.host in allowed_hosts:
-            return original_urlopen(self, method, url, *args, **kwargs)
-
-        raise RuntimeError(
-            f"The test was about to {method} {self.scheme}://{self.host}{url}"
-        )
-
-    monkeypatch.setattr(
-        "urllib3.connectionpool.HTTPConnectionPool.urlopen", urlopen_mock
-    )

src/backend/core/__init__.py

@@ -1 +0,0 @@
-"""Core root module."""

src/backend/core/admin.py

@@ -1,17 +1,46 @@
 """Admin classes and registrations for People's core app."""
-
-from django.conf import settings
-from django.contrib import admin, messages
+from django import forms
+from django.contrib import admin
 from django.contrib.auth import admin as auth_admin
 from django.utils.translation import gettext_lazy as _
 
-from treebeard.admin import TreeAdmin
-from treebeard.forms import movenodeform_factory
-
-from mailbox_manager.admin import MailDomainAccessInline
-
 from . import models
-from .plugins.registry import registry as plugin_hooks_registry
+
+
+class IdentityFormSet(forms.BaseInlineFormSet):
+    """
+    Make the "is_main" field readonly when it is True so that declaring another identity
+    works in the admin.
+    """
+
+    def add_fields(self, form, index):
+        """Disable the "is_main" field when it is set to True"""
+        super().add_fields(form, index)
+        is_main_value = form.instance.is_main if form.instance else False
+        form.fields["is_main"].disabled = is_main_value
+
+
+class IdentityInline(admin.TabularInline):
+    """Inline admin class for user identities."""
+
+    fields = (
+        "sub",
+        "email",
+        "is_main",
+        "created_at",
+        "updated_at",
+    )
+    formset = IdentityFormSet
+    model = models.Identity
+    extra = 0
+    readonly_fields = ("email", "created_at", "sub", "updated_at")
+
+    def has_add_permission(self, request, obj):
+        """
+        Identities are automatically created on successful OIDC logins.
+        Disable creating identities via the admin.
+        """
+        return False
 
 
 class TeamAccessInline(admin.TabularInline):
@@ -23,52 +52,21 @@ class TeamAccessInline(admin.TabularInline):
     readonly_fields = ("created_at", "updated_at")
 
 
-class OrganizationAccessInline(admin.TabularInline):
-    """Inline admin class for organization accesses."""
-
-    autocomplete_fields = ["user", "organization"]
-    extra = 0
-    model = models.OrganizationAccess
-    readonly_fields = ("created_at", "updated_at")
-
-
-class TeamWebhookInline(admin.TabularInline):
-    """Inline admin class for team webhooks."""
-
-    extra = 0
-    autocomplete_fields = ["team"]
-    model = models.TeamWebhook
-    readonly_fields = ("created_at", "updated_at")
-
-
 @admin.register(models.User)
 class UserAdmin(auth_admin.UserAdmin):
     """Admin class for the User model"""
 
-    autocomplete_fields = ["organization"]
     fieldsets = (
         (
             None,
             {
                 "fields": (
                     "id",
-                    "sub",
                     "password",
-                    "organization",
-                )
-            },
-        ),
-        (
-            _("Personal info"),
-            {
-                "fields": (
-                    "name",
-                    "email",
-                    "language",
-                    "timezone",
                 )
             },
         ),
+        (_("Personal info"), {"fields": ("email", "language", "timezone")}),
         (
             _("Permissions"),
             {
@@ -89,14 +87,13 @@ class UserAdmin(auth_admin.UserAdmin):
             None,
             {
                 "classes": ("wide",),
-                "fields": ("sub", "email", "password1", "password2"),
+                "fields": ("email", "password1", "password2"),
             },
         ),
     )
-    inlines = (TeamAccessInline, MailDomainAccessInline, OrganizationAccessInline)
+    inlines = (IdentityInline, TeamAccessInline)
     list_display = (
-        "get_user",
-        "organization",
+        "email",
         "created_at",
         "updated_at",
         "is_active",
@@ -106,59 +103,22 @@ class UserAdmin(auth_admin.UserAdmin):
     )
     list_filter = ("is_staff", "is_superuser", "is_device", "is_active")
     ordering = ("is_active", "-is_superuser", "-is_staff", "-is_device", "-updated_at")
-    readonly_fields = ["id", "created_at", "updated_at"]
-    search_fields = ("id", "email", "sub", "name")
-
-    def get_readonly_fields(self, request, obj=None):
-        """The sub should only be editable for a create, not for updates."""
-        if obj:
-            return self.readonly_fields + ["sub"]
-        return self.readonly_fields
-
-    def get_user(self, obj):
-        """Provide a nice display for user"""
-        return (
-            obj.name if obj.name else (obj.email if obj.email else f"[sub] {obj.sub}")
-        )
-
-    get_user.short_description = _("User")
-
-
-class TeamServiceProviderInline(admin.TabularInline):
-    """Inline admin class for service providers."""
-
-    can_delete = False
-    model = models.Team.service_providers.through
-    extra = 0
+    readonly_fields = ("id", "created_at", "updated_at")
+    search_fields = ("id", "email", "identities__sub", "identities__email")
 
 
 @admin.register(models.Team)
-class TeamAdmin(TreeAdmin):
+class TeamAdmin(admin.ModelAdmin):
     """Team admin interface declaration."""
 
-    form = movenodeform_factory(models.Team)
-    inlines = (TeamAccessInline, TeamWebhookInline, TeamServiceProviderInline)
-    exclude = ("service_providers",)  # Handled by the inline
+    inlines = (TeamAccessInline,)
     list_display = (
         "name",
+        "slug",
         "created_at",
         "updated_at",
     )
     search_fields = ("name",)
-    readonly_fields = ("path", "depth", "numchild")
-
-
-@admin.register(models.TeamAccess)
-class TeamAccessAdmin(admin.ModelAdmin):
-    """Team access admin interface declaration."""
-
-    list_display = (
-        "user",
-        "team",
-        "role",
-        "created_at",
-        "updated_at",
-    )
 
 
 @admin.register(models.Invitation)
@@ -184,121 +144,6 @@ class InvitationAdmin(admin.ModelAdmin):
         "is_expired",
     )
 
-    def get_readonly_fields(self, request, obj=None):
-        """Mark all fields read only, i.e. disable update."""
-        if obj:
-            return self.fields
-        return self.readonly_fields
-
-    def change_view(self, request, object_id, form_url="", extra_context=None):
-        """Custom edit form. Remove 'save' buttons."""
-        extra_context = extra_context or {}
-        extra_context["show_save_and_continue"] = False
-        extra_context["show_save"] = False
-        extra_context["show_save_and_add_another"] = False
-        return super().change_view(request, object_id, extra_context=extra_context)
-
     def save_model(self, request, obj, form, change):
-        """Fill in current logged-in user as issuer."""
         obj.issuer = request.user
         obj.save()
-
-
-@admin.register(models.Contact)
-class ContactAdmin(admin.ModelAdmin):
-    """Contact admin interface declaration."""
-
-    list_display = (
-        "full_name",
-        "owner",
-        "override",
-    )
-
-
-class OrganizationServiceProviderInline(admin.TabularInline):
-    """Inline admin class for service providers."""
-
-    can_delete = False
-    model = models.Organization.service_providers.through
-    extra = 0
-
-
-@admin.action(description=_("Run post creation plugins"), permissions=["change"])
-def run_post_creation_plugins(modeladmin, request, queryset):  # pylint: disable=unused-argument
-    """Run the post creation plugins for the selected organizations."""
-    for organization in queryset:
-        plugin_hooks_registry.execute_hook("organization_created", organization)
-
-    messages.success(
-        request,
-        _("Post creation plugins have been run for the selected organizations."),
-    )
-
-
-@admin.register(models.Organization)
-class OrganizationAdmin(admin.ModelAdmin):
-    """Admin interface for organizations."""
-
-    actions = [run_post_creation_plugins]
-    list_display = (
-        "name",
-        "is_active",
-        "created_at",
-        "updated_at",
-    )
-    list_filter = ("is_active",)
-    search_fields = ("name",)
-    inlines = (OrganizationAccessInline, OrganizationServiceProviderInline)
-    exclude = ("service_providers",)  # Handled by the inline
-
-    def get_actions(self, request):
-        """Adapt actions list to the context."""
-        actions = super().get_actions(request)
-        if not plugin_hooks_registry.get_callbacks("organization_created"):
-            actions.pop("run_post_creation_plugins", None)
-        return actions
-
-
-@admin.register(models.OrganizationAccess)
-class OrganizationAccessAdmin(admin.ModelAdmin):
-    """Organization access admin interface declaration."""
-
-    autocomplete_fields = ("user", "organization")
-    list_display = (
-        "user",
-        "organization",
-        "role",
-        "created_at",
-        "updated_at",
-    )
-
-
-@admin.register(models.ServiceProvider)
-class ServiceProviderAdmin(admin.ModelAdmin):
-    """Admin interface for service providers."""
-
-    list_display = (
-        "name",
-        "audience_id",
-        "created_at",
-        "updated_at",
-    )
-    search_fields = ("name", "audience_id")
-    readonly_fields = ("created_at", "updated_at")
-
-
-@admin.register(models.AccountService)
-class AccountServiceAdmin(admin.ModelAdmin):
-    """Admin interface for account services."""
-
-    list_display = ("name", "created_at", "updated_at")
-    readonly_fields = ("api_key", "created_at", "updated_at")
-
-    def get_form(self, request, obj=None, change=False, **kwargs):
-        """Add help text to the scopes field to provide list of available scopes."""
-        form = super().get_form(request, obj, change, **kwargs)
-        form.base_fields[
-            "scopes"
-        ].help_text = f"Scopes define what the service can access. \
-            Available scopes: {', '.join(settings.ACCOUNT_SERVICE_SCOPES)}"
-        return form

src/backend/core/api/__init__.py

@@ -1,5 +1,4 @@
 """People core API endpoints"""
-
 from django.conf import settings
 from django.core.exceptions import ValidationError
 
@@ -23,8 +22,6 @@ def exception_handler(exc, context):
             detail = exc.message
         elif hasattr(exc, "messages"):
             detail = exc.messages
-        else:
-            detail = ""
 
         exc = drf_exceptions.ValidationError(detail=detail)
 

src/backend/core/api/client/__init__.py

@@ -1 +0,0 @@
-"""People core client API endpoints"""

src/backend/core/api/client/viewsets.py

@@ -1,673 +0,0 @@
-"""API endpoints"""
-
-import datetime
-import operator
-from functools import reduce
-
-from django.conf import settings
-from django.db.models import OuterRef, Q, Subquery, Value
-from django.db.models.functions import Coalesce
-from django.utils import timezone
-from django.utils.decorators import method_decorator
-from django.views.decorators.cache import cache_page
-
-from rest_framework import (
-    decorators,
-    exceptions,
-    filters,
-    mixins,
-    pagination,
-    response,
-    throttling,
-    views,
-    viewsets,
-)
-from rest_framework.permissions import AllowAny
-
-from core import models
-from core.api import permissions
-from core.api.client import serializers
-from core.utils.raw_sql import gen_sql_filter_json_array
-
-from mailbox_manager import enums
-from mailbox_manager import models as domains_models
-
-
-class NestedGenericViewSet(viewsets.GenericViewSet):
-    """
-    A generic Viewset aims to be used in a nested route context.
-    e.g: `/api/v1.0/resource_1/<resource_1_pk>/resource_2/<resource_2_pk>/`
-
-    It allows to define all url kwargs and lookup fields to perform the lookup.
-    """
-
-    lookup_fields: list[str] = ["pk"]
-    lookup_url_kwargs: list[str] = []
-
-    def __getattribute__(self, item):
-        """
-        This method is overridden to allow to get the last lookup field or lookup url kwarg
-        when accessing the `lookup_field` or `lookup_url_kwarg` attribute. This is useful
-        to keep compatibility with all methods used by the parent class `GenericViewSet`.
-        """
-        if item in ["lookup_field", "lookup_url_kwarg"]:
-            return getattr(self, item + "s", [None])[-1]
-
-        return super().__getattribute__(item)
-
-    def get_queryset(self):
-        """
-        Get the list of items for this view.
-
-        `lookup_fields` attribute is enumerated here to perform the nested lookup.
-        """
-        queryset = super().get_queryset()
-
-        # The last lookup field is removed to perform the nested lookup as it corresponds
-        # to the object pk, it is used within get_object method.
-        lookup_url_kwargs = (
-            self.lookup_url_kwargs[:-1]
-            if self.lookup_url_kwargs
-            else self.lookup_fields[:-1]
-        )
-
-        filter_kwargs = {}
-        for index, lookup_url_kwarg in enumerate(lookup_url_kwargs):
-            if lookup_url_kwarg not in self.kwargs:
-                raise KeyError(
-                    f"Expected view {self.__class__.__name__} to be called with a URL "
-                    f'keyword argument named "{lookup_url_kwarg}". Fix your URL conf, or '
-                    "set the `.lookup_fields` attribute on the view correctly."
-                )
-
-            filter_kwargs.update(
-                {self.lookup_fields[index]: self.kwargs[lookup_url_kwarg]}
-            )
-
-        return queryset.filter(**filter_kwargs)
-
-
-class SerializerPerActionMixin:
-    """
-    A mixin to allow to define serializer classes for each action.
-
-    This mixin is useful to avoid to define a serializer class for each action in the
-    `get_serializer_class` method.
-
-    Example:
-    ```
-    class MyViewSet(SerializerPerActionMixin, viewsets.GenericViewSet):
-        serializer_class = MySerializer
-        list_serializer_class = MyListSerializer
-        retrieve_serializer_class = MyRetrieveSerializer
-    ```
-    """
-
-    def get_serializer_class(self):
-        """
-        Return the serializer class to use depending on the action.
-        """
-        if serializer_class := getattr(self, f"{self.action}_serializer_class", None):
-            return serializer_class
-        return super().get_serializer_class()
-
-
-class Pagination(pagination.PageNumberPagination):
-    """Pagination to display no more than 100 objects per page sorted by creation date."""
-
-    max_page_size = 100
-    page_size_query_param = "page_size"
-
-
-class BurstRateThrottle(throttling.UserRateThrottle):
-    """
-    Throttle rate for minutes. See DRF section in settings for default value.
-    """
-
-    scope = "burst"
-
-
-class SustainedRateThrottle(throttling.UserRateThrottle):
-    """
-    Throttle rate for hours. See DRF section in settings for default value.
-    """
-
-    scope = "sustained"
-
-
-# pylint: disable=too-many-ancestors
-class ContactViewSet(
-    mixins.CreateModelMixin,
-    mixins.DestroyModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-):
-    """Contact ViewSet"""
-
-    permission_classes = [permissions.AccessPermission]
-    queryset = models.Contact.objects.select_related("user", "owner").all()
-    serializer_class = serializers.ContactSerializer
-    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
-    ordering_fields = ["full_name", "short_name", "created_at"]
-    ordering = ["full_name"]
-
-    def list(self, request, *args, **kwargs):
-        """Limit listed users by a query with throttle protection."""
-        user = self.request.user
-        queryset = self.filter_queryset(self.get_queryset())
-
-        # List only contacts that:
-        queryset = queryset.filter(
-            # - is public (owner is None)
-            Q(owner__isnull=True)
-            # - are owned by the user
-            | Q(owner=user)
-            # - are profile contacts for a user from the same organization
-            | Q(user__organization_id=user.organization_id),
-            # - are not overriden by another contact
-            overridden_by__isnull=True,
-        )
-
-        # Search by case-insensitive and accent-insensitive on:
-        # - full name
-        # - short name
-        # - email (from data `emails` field)
-        if query := self.request.GET.get("q", ""):
-            queryset = queryset.filter(
-                Q(full_name__unaccent__icontains=query)
-                | Q(short_name__unaccent__icontains=query)
-                | Q(
-                    id__in=gen_sql_filter_json_array(
-                        queryset.model,
-                        "data->'emails'",
-                        "value",
-                        query,
-                    )
-                )
-            )
-
-        serializer = self.get_serializer(queryset, many=True)
-        return response.Response(serializer.data)
-
-    def perform_create(self, serializer):
-        """Set the current user as owner of the newly created contact."""
-        user = self.request.user
-        serializer.validated_data["owner"] = user
-        return super().perform_create(serializer)
-
-
-class OrganizationViewSet(
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    Organization ViewSet
-
-    GET /api/organizations/<organization_id>/
-        Return the organization details for the given id.
-
-    PUT /api/organizations/<organization_id>/
-        Update the organization details for the given id.
-
-    PATCH /api/organizations/<organization_id>/
-        Partially update the organization details for the given id.
-    """
-
-    permission_classes = [permissions.AccessPermission]
-    queryset = models.Organization.objects.all()
-    serializer_class = serializers.OrganizationSerializer
-    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
-
-    def get_queryset(self):
-        """Limit listed organizations to the one the user belongs to."""
-        return (
-            super()
-            .get_queryset()
-            .filter(pk=self.request.user.organization_id)
-            .annotate(
-                user_role=Subquery(
-                    models.OrganizationAccess.objects.filter(
-                        user=self.request.user, organization=OuterRef("pk")
-                    ).values("role")[:1]
-                )
-            )
-        )
-
-
-class UserViewSet(
-    SerializerPerActionMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-    mixins.ListModelMixin,
-):
-    """
-    User viewset for all interactions with user infos and teams.
-
-    GET /api/users/&q=query
-        Return a list of users whose email or name matches the query.
-    """
-
-    permission_classes = [permissions.IsSelf]
-    queryset = (
-        models.User.objects.select_related("organization").all().order_by("-created_at")
-    )
-    serializer_class = serializers.UserSerializer
-    get_me_serializer_class = serializers.UserMeSerializer
-    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
-    pagination_class = Pagination
-
-    def get_queryset(self):
-        """Limit listed users by a query. Pagination and throttle protection apply."""
-        queryset = self.queryset
-
-        if self.action == "list":
-            # Filter active users
-            # and users from same organization
-            queryset = queryset.filter(
-                is_active=True, organization_id=self.request.user.organization_id
-            )
-
-            # Exclude all users already in the given team
-            if team_id := self.request.GET.get("team_id", ""):
-                queryset = queryset.exclude(teams__id=team_id)
-
-            # Search by case-insensitive and accent-insensitive
-            if query := self.request.GET.get("q", ""):
-                queryset = queryset.filter(
-                    Q(name__unaccent__icontains=query)
-                    | Q(email__unaccent__icontains=query)
-                )
-
-        return queryset
-
-    @decorators.action(
-        detail=False,
-        methods=["get"],
-        url_name="me",
-        url_path="me",
-    )
-    def get_me(self, request):
-        """
-        Return information on currently logged user
-        """
-        user = request.user
-        return response.Response(self.get_serializer(user).data)
-
-
-class TeamViewSet(
-    mixins.CreateModelMixin,
-    mixins.DestroyModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-):
-    """Team ViewSet"""
-
-    permission_classes = [permissions.TeamPermission, permissions.AccessPermission]
-    serializer_class = serializers.TeamSerializer
-    filter_backends = [filters.OrderingFilter]
-    ordering_fields = ["created_at", "name", "path"]
-    ordering = ["-created_at"]
-    queryset = models.Team.objects.all()
-    pagination_class = None
-
-    def get_queryset(self):
-        """Custom queryset to get user related teams."""
-        teams_queryset = models.Team.objects.filter(
-            accesses__user=self.request.user,
-        )
-        depth_path = teams_queryset.values("depth", "path")
-
-        if not depth_path:
-            return models.Team.objects.none()
-
-        user_role_query = models.TeamAccess.objects.filter(
-            user=self.request.user, team=OuterRef("pk")
-        ).values("role")[:1]
-
-        return (
-            models.Team.objects.prefetch_related("accesses", "service_providers")
-            .filter(
-                reduce(
-                    operator.or_,
-                    (
-                        Q(
-                            # The team the user has access to
-                            depth=d["depth"],
-                            path=d["path"],
-                        )
-                        | Q(
-                            # The parent team the user has access to
-                            depth__lt=d["depth"],
-                            path__startswith=d["path"][: models.Team.steplen],
-                            organization_id=self.request.user.organization_id,
-                        )
-                        for d in depth_path
-                    ),
-                ),
-            )
-            # Abilities are computed based on logged-in user's role for the team
-            # and if the user does not have access, it's ok to consider them as a member
-            # because it's a parent team.
-            .annotate(
-                user_role=Coalesce(
-                    Subquery(user_role_query), Value(models.RoleChoices.MEMBER.value)
-                )
-            )
-        )
-
-    def perform_create(self, serializer):
-        """Set the current user as owner of the newly created team."""
-        team = serializer.save()
-        models.TeamAccess.objects.create(
-            team=team,
-            user=self.request.user,
-            role=models.RoleChoices.OWNER,
-        )
-
-
-class TeamAccessViewSet(
-    mixins.CreateModelMixin,
-    mixins.DestroyModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    API ViewSet for all interactions with team accesses.
-
-    GET /api/v1.0/teams/<team_id>/accesses/:<team_access_id>
-        Return list of all team accesses related to the logged-in user or one
-        team access if an id is provided.
-
-    POST /api/v1.0/teams/<team_id>/accesses/ with expected data:
-        - user: str
-        - role: str [owner|admin|member]
-        Return newly created team access
-
-    PUT /api/v1.0/teams/<team_id>/accesses/<team_access_id>/ with expected data:
-        - role: str [owner|admin|member]
-        Return updated team access
-
-    PATCH /api/v1.0/teams/<team_id>/accesses/<team_access_id>/ with expected data:
-        - role: str [owner|admin|member]
-        Return partially updated team access
-
-    DELETE /api/v1.0/teams/<team_id>/accesses/<team_access_id>/
-        Delete targeted team access
-    """
-
-    lookup_field = "pk"
-    pagination_class = Pagination
-    permission_classes = [permissions.AccessPermission]
-    queryset = (
-        models.TeamAccess.objects.all().select_related("user").order_by("-created_at")
-    )
-    list_serializer_class = serializers.TeamAccessReadOnlySerializer
-    detail_serializer_class = serializers.TeamAccessSerializer
-
-    filter_backends = [filters.OrderingFilter]
-    ordering = ["role"]
-    ordering_fields = ["role", "user__email", "user__name"]
-
-    def get_permissions(self):
-        """User only needs to be authenticated to list team accesses"""
-        if self.action == "list":
-            permission_classes = [permissions.IsAuthenticated]
-        else:
-            return super().get_permissions()
-
-        return [permission() for permission in permission_classes]
-
-    def get_serializer_context(self):
-        """Extra context provided to the serializer class."""
-        context = super().get_serializer_context()
-        context["team_id"] = self.kwargs["team_id"]
-        return context
-
-    def get_serializer_class(self):
-        """Chooses list or detail serializer according to the action."""
-        if self.action in {"list", "retrieve"}:
-            return self.list_serializer_class
-        return self.detail_serializer_class
-
-    def get_queryset(self):
-        """Return the queryset according to the action."""
-        queryset = super().get_queryset()
-        queryset = queryset.filter(team=self.kwargs["team_id"])
-
-        if self.action in {"list", "retrieve"}:
-            if query := self.request.GET.get("q", ""):
-                queryset = queryset.filter(
-                    Q(user__email__unaccent__icontains=query)
-                    | Q(user__name__unaccent__icontains=query)
-                )
-
-            # Determine which role the logged-in user has in the team
-            user_role_query = models.TeamAccess.objects.filter(
-                user=self.request.user, team=self.kwargs["team_id"]
-            ).values("role")[:1]
-
-            queryset = (
-                # The logged-in user should be part of a team to see its accesses
-                queryset.filter(
-                    team__accesses__user=self.request.user,
-                )
-                # Abilities are computed based on logged-in user's role and
-                # the user role on each team access
-                .annotate(
-                    user_role=Subquery(user_role_query),
-                )
-                .select_related("user")
-                .distinct()
-            )
-        return queryset
-
-    def destroy(self, request, *args, **kwargs):
-        """Forbid deleting the last owner access"""
-        instance = self.get_object()
-        team = instance.team
-
-        # Check if the access being deleted is the last owner access for the team
-        if instance.role == "owner" and team.accesses.filter(role="owner").count() == 1:
-            return response.Response(
-                {"detail": "Cannot delete the last owner access for the team."},
-                status=400,
-            )
-
-        return super().destroy(request, *args, **kwargs)
-
-    def perform_update(self, serializer):
-        """Check that we don't change the role if it leads to losing the last owner."""
-        instance = serializer.instance
-
-        # Check if the role is being updated and the new role is not "owner"
-        if (
-            "role" in self.request.data
-            and self.request.data["role"] != models.RoleChoices.OWNER
-        ):
-            team = instance.team
-            # Check if the access being updated is the last owner access for the team
-            if (
-                instance.role == models.RoleChoices.OWNER
-                and team.accesses.filter(role=models.RoleChoices.OWNER).count() == 1
-            ):
-                message = "Cannot change the role to a non-owner role for the last owner access."
-                raise exceptions.ValidationError({"role": message})
-
-        serializer.save()
-
-
-class InvitationViewset(
-    mixins.CreateModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.DestroyModelMixin,
-    viewsets.GenericViewSet,
-):
-    """API ViewSet for user invitations to team.
-
-    GET /api/v1.0/teams/<team_id>/invitations/:<invitation_id>/
-        Return list of invitations related to that team or or one
-        team access if an id is provided.
-
-    POST /api/v1.0/teams/<team_id>/invitations/ with expected data:
-        - email: str
-        - role: str [owner|admin|member]
-        - issuer : User, automatically added from user making query, if allowed
-        - team : Team, automatically added from requested URI
-        Return newly created invitation
-
-    PUT / PATCH : Not permitted. Instead of updating your invitation,
-        delete and create a new one.
-
-    DELETE  /api/v1.0/teams/<team_id>/invitations/<invitation_id>/
-        Delete targeted invitation
-    """
-
-    lookup_field = "id"
-    pagination_class = Pagination
-    permission_classes = [permissions.AccessPermission]
-    queryset = (
-        models.Invitation.objects.all().select_related("team").order_by("-created_at")
-    )
-    serializer_class = serializers.InvitationSerializer
-
-    def get_permissions(self):
-        """User only needs to be authenticated to list invitations"""
-        if self.action == "list":
-            permission_classes = [permissions.IsAuthenticated]
-        else:
-            return super().get_permissions()
-
-        return [permission() for permission in permission_classes]
-
-    def get_serializer_context(self):
-        """Extra context provided to the serializer class."""
-        context = super().get_serializer_context()
-        context["team_id"] = self.kwargs["team_id"]
-        return context
-
-    def get_queryset(self):
-        """Return the queryset according to the action."""
-        queryset = super().get_queryset()
-        queryset = queryset.filter(team=self.kwargs["team_id"])
-
-        if self.action == "list":
-            # Determine which role the logged-in user has in the team
-            user_role_query = models.TeamAccess.objects.filter(
-                user=self.request.user, team=self.kwargs["team_id"]
-            ).values("role")[:1]
-
-            queryset = (
-                # The logged-in user should be part of a team to see its accesses
-                queryset.filter(
-                    team__accesses__user=self.request.user,
-                )
-                # Abilities are computed based on logged-in user's role and
-                # the user role on each team access
-                .annotate(user_role=Subquery(user_role_query))
-                .distinct()
-            )
-        return queryset
-
-
-class ConfigView(views.APIView):
-    """API ViewSet for sharing some public settings."""
-
-    permission_classes = [AllowAny]
-
-    def get(self, request):
-        """
-        GET /api/v1.0/config/
-            Return a dictionary of public settings.
-        """
-        array_settings = [
-            "LANGUAGES",
-            "FEATURES",
-            "RELEASE",
-            "COMMIT",
-            "CRISP_WEBSITE_ID",
-        ]
-        dict_settings = {}
-        for setting in array_settings:
-            dict_settings[setting] = getattr(settings, setting)
-
-        return response.Response(dict_settings)
-
-
-class StatView(views.APIView):
-    """API ViewSet for sharing some public metrics."""
-
-    permission_classes = [AllowAny]
-
-    @method_decorator(cache_page(3600))
-    def get(self, request):
-        """
-        GET /api/v1.0/stats/
-            Return a dictionary of public metrics.
-        """
-        context = {
-            "total_users": models.User.objects.count(),
-            "mau": models.User.objects.filter(
-                last_login__gte=timezone.now() - datetime.timedelta(30)
-            ).count(),
-            "teams": models.Team.objects.count(),
-            "active_domains": domains_models.MailDomain.objects.filter(
-                status=enums.MailDomainStatusChoices.ENABLED
-            ).count(),
-            "mailboxes": domains_models.Mailbox.objects.count(),
-            "aliases": domains_models.Alias.objects.count(),
-        }
-        return response.Response(context)
-
-
-class ServiceProviderFilter(filters.BaseFilterBackend):
-    """
-    Filter service providers.
-    """
-
-    def filter_queryset(self, request, queryset, view):
-        """
-        Filter service providers by audience or name.
-        """
-        if name := request.GET.get("name"):
-            queryset = queryset.filter(name__icontains=name)
-        if audience_id := request.GET.get("audience_id"):
-            queryset = queryset.filter(audience_id=audience_id)
-        return queryset
-
-
-class ServiceProviderViewSet(
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    API ViewSet for all interactions with service providers.
-
-    GET /api/v1.0/service-providers/
-        Return a list of service providers.
-
-    GET /api/v1.0/service-providers/<service_provider_id>/
-        Return a service provider.
-    """
-
-    permission_classes = [permissions.IsAuthenticated]
-    queryset = models.ServiceProvider.objects.all()
-    serializer_class = serializers.ServiceProviderSerializer
-    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
-    pagination_class = Pagination
-    filter_backends = [filters.OrderingFilter, ServiceProviderFilter]
-    ordering = ["name"]
-    ordering_fields = ["name", "created_at"]
-
-    def get_queryset(self):
-        """Filter the queryset to limit results to user's organization."""
-        queryset = super().get_queryset()
-        queryset = queryset.filter(organizations__id=self.request.user.organization_id)
-        return queryset

src/backend/core/api/permissions.py

@@ -1,11 +1,8 @@
 """Permission handlers for the People core app."""
-
 from django.core import exceptions
 
 from rest_framework import permissions
 
-from core import models
-
 
 class IsAuthenticated(permissions.BasePermission):
     """
@@ -14,13 +11,13 @@ class IsAuthenticated(permissions.BasePermission):
     """
 
     def has_permission(self, request, view):
-        """Check auth token first."""
         return bool(request.auth) if request.auth else request.user.is_authenticated
 
 
 class IsSelf(IsAuthenticated):
     """
-    Allows access only to user's own data.
+    Allows access only to authenticated users. Alternative method checking the presence
+    of the auth token to avoid hitting the database.
     """
 
     def has_object_permission(self, request, view, obj):
@@ -55,43 +52,3 @@ class AccessPermission(IsAuthenticated):
         """Check permission for a given object."""
         abilities = obj.get_abilities(request.user)
         return abilities.get(request.method.lower(), False)
-
-
-class TeamPermission(IsAuthenticated):
-    """Permission class for team objects viewset."""
-
-    def has_permission(self, request, view):
-        """Check permission only when the user tries to create a new team."""
-        if not super().has_permission(request, view):
-            return False
-
-        if request.method != "POST":
-            return True
-
-        abilities = request.user.get_abilities()
-        return abilities["teams"]["can_create"]
-
-
-class TeamInvitationCreationPermission(IsAuthenticated):
-    """Permission class that allows only team owners and admins to perform actions."""
-
-    def has_permission(self, request, view):
-        """Check if user is authenticated and has required role for the team."""
-        if not super().has_permission(request, view):
-            return False
-
-        # Only check roles for edition operations
-        if request.method in permissions.SAFE_METHODS:
-            return True
-
-        team_id = view.kwargs.get("team_id")
-        if not team_id:
-            return False
-
-        team_access = models.TeamAccess.objects.filter(
-            team_id=team_id,
-            user=request.user,
-            role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
-        ).exists()
-
-        return team_access

src/backend/core/api/resource_server/__init__.py

@@ -1 +0,0 @@
-"""People core resource server API endpoints"""

src/backend/core/api/resource_server/scim/__init__.py

@@ -1 +0,0 @@
-"""SCIM compliant API for resource server"""

src/backend/core/api/resource_server/scim/exceptions.py

@@ -1,16 +0,0 @@
-"""Exceptions for SCIM API."""
-
-from django.conf import settings
-
-from core.api.resource_server.scim.response import ScimJsonResponse
-
-
-def scim_exception_handler(exc, _context):
-    """Handle SCIM exceptions and return them in the correct format."""
-    data = {
-        "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
-        "status": str(exc.status_code),
-        "detail": str(exc.detail) if settings.DEBUG else "",
-    }
-
-    return ScimJsonResponse(data, status=exc.status_code)

src/backend/core/api/resource_server/scim/response.py

@@ -1,16 +0,0 @@
-"""SCIM API response classes."""
-
-from rest_framework.response import Response
-
-
-class ScimJsonResponse(Response):
-    """
-    Custom JSON response class for SCIM API.
-
-    This class sets the content type to "application/json+scim" for SCIM
-    responses.
-    """
-
-    def __init__(self, *args, **kwargs):
-        """JSON response with enforced SCIM content type."""
-        super().__init__(*args, content_type="application/json+scim", **kwargs)

src/backend/core/api/resource_server/scim/serializers.py

@@ -1,90 +0,0 @@
-"""SCIM serializers for resource server API."""
-
-from django.urls import reverse
-
-from rest_framework import serializers
-
-from core import models
-
-
-class SCIMUserSerializer(serializers.ModelSerializer):
-    """Serialize users in SCIM format."""
-
-    schemas = serializers.SerializerMethodField()
-    userName = serializers.CharField(source="sub")
-    displayName = serializers.CharField(source="name")
-    emails = serializers.SerializerMethodField()
-    meta = serializers.SerializerMethodField()
-    groups = serializers.SerializerMethodField()
-    active = serializers.BooleanField(source="is_active")
-
-    class Meta:
-        model = models.User
-        fields = [
-            "id",
-            "schemas",
-            "active",
-            "userName",
-            "displayName",
-            "emails",
-            "groups",
-            "meta",
-        ]
-        read_only_fields = [
-            "id",
-            "schemas",
-            "active",
-            "userName",
-            "displayName",
-            "emails",
-            "groups",
-            "meta",
-        ]
-
-    def get_schemas(self, _obj):
-        """Return the SCIM schemas for the user."""
-        return ["urn:ietf:params:scim:schemas:core:2.0:User"]
-
-    def get_emails(self, obj):
-        """Return the user's email as a list of email objects."""
-        if obj.email:
-            return [
-                {
-                    "value": obj.email,
-                    "primary": True,
-                    "type": "work",
-                }
-            ]
-        return []
-
-    def get_groups(self, obj):
-        """
-        Return the groups the user belongs to.
-
-        WARNING: you need to prefetch the team accesses in the
-        viewset to avoid N+1 queries.
-        """
-        return [
-            {
-                "value": str(team_access.team.external_id),
-                "display": team_access.team.name,
-                "type": "direct",
-            }
-            for team_access in obj.accesses.all()
-        ]
-
-    def get_meta(self, obj):
-        """Return metadata about the user."""
-        request = self.context.get("request")
-        location = (
-            f"{request.build_absolute_uri('/').rstrip('/')}{reverse('scim-me-list')}"
-            if request
-            else None
-        )
-
-        return {
-            "resourceType": "User",
-            "created": obj.created_at.isoformat(),
-            "lastModified": obj.updated_at.isoformat(),
-            "location": location,
-        }

src/backend/core/api/resource_server/scim/viewsets.py

@@ -1,62 +0,0 @@
-"""Resource server SCIM API endpoints"""
-
-from django.contrib.auth import get_user_model
-from django.db.models import Prefetch, Q
-
-from lasuite.oidc_resource_server.mixins import ResourceServerMixin
-from rest_framework import (
-    viewsets,
-)
-
-from core.api import permissions
-from core.models import TeamAccess
-
-from . import serializers
-from .exceptions import scim_exception_handler
-from .response import ScimJsonResponse
-
-User = get_user_model()
-
-
-class MeViewSet(ResourceServerMixin, viewsets.ViewSet):
-    """
-    SCIM-compliant ViewSet for the /Me endpoint.
-
-    This endpoint provides information about the currently authenticated user
-    in SCIM (System for Cross-domain Identity Management) format.
-
-    Features:
-    - Returns user details in SCIM format.
-    - Includes the user's teams, restricted to the audience.
-
-    Limitations:
-    - Does not currently support managing Team hierarchies.
-
-    Endpoint:
-    GET /resource-server/v1.0/scim/Me/
-        Retrieves the authenticated user's details and associated teams.
-    """
-
-    permission_classes = [permissions.IsAuthenticated]
-    serializer_class = serializers.SCIMUserSerializer
-
-    def get_exception_handler(self):
-        """Override the default exception handler to use SCIM-specific handling."""
-        return scim_exception_handler
-
-    def list(self, request, *args, **kwargs):
-        """Return the current user's details in SCIM format."""
-        service_provider_audience = self._get_service_provider_audience()
-
-        user = User.objects.prefetch_related(
-            Prefetch(
-                "accesses",
-                queryset=TeamAccess.objects.select_related("team").filter(
-                    Q(team__service_providers__audience_id=service_provider_audience)
-                    | Q(team__is_visible_all_services=True)
-                ),
-            )
-        ).get(pk=request.user.pk)
-
-        serializer = self.serializer_class(user, context={"request": request})
-        return ScimJsonResponse(serializer.data)

src/backend/core/api/resource_server/serializers.py

@@ -1,78 +0,0 @@
-"""Client serializers for the People core app resource server API."""
-
-from rest_framework import serializers
-
-from core import models
-
-
-class TeamSerializer(serializers.ModelSerializer):
-    """Serialize teams."""
-
-    class Meta:
-        model = models.Team
-        fields = [
-            "id",
-            "created_at",
-            "depth",
-            "is_visible_all_services",
-            "name",
-            "numchild",
-            "path",
-            "updated_at",
-        ]
-        read_only_fields = [
-            "id",
-            "created_at",
-            "depth",
-            "numchild",
-            "path",
-            "updated_at",
-        ]
-
-    def create(self, validated_data):
-        """
-        Create a new team with organization enforcement.
-
-        In this context, called as a resource server,
-        the team service provider is enforced.
-
-        When the service provider audience is unknown it is created on the fly.
-        """
-        sp_audience = self.context["from_service_provider_audience"]
-        service_provider, _created = models.ServiceProvider.objects.get_or_create(
-            audience_id=sp_audience
-        )
-
-        # Note: this is not the purpose of this API to check the user has an organization
-        return super().create(
-            validated_data=validated_data
-            | {
-                "organization_id": self.context["request"].user.organization_id,
-                "service_providers": [service_provider],
-            },
-        )
-
-
-class InvitationSerializer(serializers.ModelSerializer):
-    """Serialize invitations."""
-
-    class Meta:
-        model = models.Invitation
-        fields = ["id", "created_at", "email", "team", "role", "issuer", "is_expired"]
-        read_only_fields = ["id", "created_at", "team", "issuer", "is_expired"]
-
-    def validate(self, attrs):
-        """Fill team and issuer from request."""
-        is_team_available_for_service_provider = models.Team.objects.filter(
-            id=self.context["team_id"],
-            service_providers__audience_id=self.context[
-                "from_service_provider_audience"
-            ],
-        ).exists()
-        if not is_team_available_for_service_provider:
-            raise serializers.ValidationError({"team": "Team not found."})
-
-        attrs["team_id"] = self.context["team_id"]
-        attrs["issuer"] = self.context["request"].user  # User is authenticated
-
-        return attrs

src/backend/core/api/resource_server/viewsets.py

@@ -1,202 +0,0 @@
-"""Resource server API endpoints"""
-
-import operator
-from functools import reduce
-
-from django.db.models import OuterRef, Prefetch, Q, Subquery, Value
-from django.db.models.functions import Coalesce
-
-from lasuite.oidc_resource_server.mixins import ResourceServerMixin
-from rest_framework import (
-    filters,
-    mixins,
-    viewsets,
-)
-
-from core import models
-from core.api import permissions
-from core.api.client.viewsets import Pagination
-
-from . import serializers
-
-
-class TeamViewSet(  # pylint: disable=too-many-ancestors
-    ResourceServerMixin,
-    mixins.CreateModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    Team ViewSet dedicated to the resource server.
-
-    The DELETE method is not allowed for now, because the use case is
-    not clear yet and it comes with complexity to know if we can delete
-    a team or not (eg. if a team has other SP, it might not be deleted
-    but what do we do then, only remove the current SP?).
-
-    GET /resource-server/v1.0/teams/
-        Return list of Teams of the user and available for the audience.
-
-    POST /resource-server/v1.0/teams/
-        Create a new Team for the user for the audience.
-
-    GET /resource-server/v1.0/teams/{team_id}/
-        Return the Team details if available for the audience.
-
-    PUT /resource-server/v1.0/teams/{team_id}/
-        Update the Team details (only name for now).
-
-    """
-
-    permission_classes = [permissions.AccessPermission]
-    serializer_class = serializers.TeamSerializer
-    filter_backends = [filters.OrderingFilter]
-    ordering_fields = ["created_at"]
-    ordering = ["-created_at"]
-    queryset = models.Team.objects.all()
-    pagination_class = Pagination
-
-    def get_queryset(self):
-        """Custom queryset to get user related teams."""
-        teams_queryset = models.Team.objects.filter(
-            accesses__user=self.request.user,
-        )
-        depth_path = teams_queryset.values("depth", "path")
-
-        if not depth_path:
-            return models.Team.objects.none()
-
-        user_role_query = models.TeamAccess.objects.filter(
-            user=self.request.user, team=OuterRef("pk")
-        ).values("role")[:1]
-
-        service_provider_audience = self._get_service_provider_audience()
-        service_provider_prefetch = Prefetch(
-            "service_providers",
-            queryset=models.ServiceProvider.objects.filter(
-                audience_id=service_provider_audience
-            ),
-        )
-
-        return (
-            models.Team.objects.prefetch_related(
-                "accesses",
-                service_provider_prefetch,
-            )
-            .filter(
-                reduce(
-                    operator.or_,
-                    (
-                        Q(
-                            # The team the user has access to
-                            depth=d["depth"],
-                            path=d["path"],
-                        )
-                        | Q(
-                            # The parent team the user has access to
-                            depth__lt=d["depth"],
-                            path__startswith=d["path"][: models.Team.steplen],
-                            organization_id=self.request.user.organization_id,
-                        )
-                        for d in depth_path
-                    ),
-                ),
-                Q(service_providers__audience_id=service_provider_audience)
-                | Q(is_visible_all_services=True),
-            )
-            # Abilities are computed based on logged-in user's role for the team
-            # and if the user does not have access, it's ok to consider them as a member
-            # because it's a parent team.
-            .annotate(
-                user_role=Coalesce(
-                    Subquery(user_role_query), Value(models.RoleChoices.MEMBER.value)
-                )
-            )
-        )
-
-    def perform_create(self, serializer):
-        """Set the current user as owner of the newly created team."""
-        team = serializer.save()
-        models.TeamAccess.objects.create(
-            team=team,
-            user=self.request.user,
-            role=models.RoleChoices.OWNER,
-        )
-
-
-class InvitationViewset(  # pylint: disable=too-many-ancestors
-    ResourceServerMixin,
-    mixins.CreateModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.DestroyModelMixin,
-    viewsets.GenericViewSet,
-):
-    """API ViewSet for user invitations to team via resource server.
-
-    GET /resource-server/v1.0/teams/<team_id>/invitations/:<invitation_id>/
-        Return list of invitations related to that team or one
-        team access if an id is provided.
-
-    POST /resource-server/v1.0/teams/<team_id>/invitations/ with expected data:
-        - email: str
-        - role: str [owner|admin|member]
-        - issuer : User, automatically added from user making query, if allowed
-        - team : Team, automatically added from requested URI
-        Return newly created invitation
-
-    PUT / PATCH : Not permitted. Instead of updating your invitation,
-        delete and create a new one.
-
-    DELETE  /resource-server/v1.0/teams/<team_id>/invitations/<invitation_id>/
-        Delete targeted invitation
-    """
-
-    lookup_field = "id"
-    pagination_class = Pagination
-    permission_classes = [permissions.AccessPermission]
-    serializer_class = serializers.InvitationSerializer
-
-    def get_permissions(self):
-        """Set specific permissions based on the action."""
-        if self.action == "list":
-            permission_classes = [permissions.IsAuthenticated]
-        elif self.action == "create":
-            permission_classes = [permissions.TeamInvitationCreationPermission]
-        else:
-            permission_classes = [permissions.AccessPermission]
-
-        return [permission() for permission in permission_classes]
-
-    def get_serializer_context(self):
-        """Extra context provided to the serializer class."""
-        context = super().get_serializer_context()
-        context["team_id"] = self.kwargs["team_id"]
-        return context
-
-    def get_queryset(self):
-        """Return the queryset according to the action."""
-        service_provider_audience = self._get_service_provider_audience()
-
-        # Determine which role the logged-in user has in the team
-        user_role_query = models.TeamAccess.objects.filter(
-            user=self.request.user, team=self.kwargs["team_id"]
-        ).values("role")[:1]
-
-        queryset = (
-            models.Invitation.objects.select_related("team")
-            .filter(
-                team=self.kwargs["team_id"],
-                # The logged-in user should be part of a team to see its accesses
-                team__accesses__user=self.request.user,
-                # The team should be accessible by the service provider audience
-                team__service_providers__audience_id=service_provider_audience,
-            )
-            .annotate(user_role=Subquery(user_role_query))
-            .order_by("-created_at")
-            .distinct()
-        )
-
-        return queryset

src/backend/core/api/serializers.py

@@ -1,46 +1,30 @@
 """Client serializers for the People core app."""
-
 from rest_framework import exceptions, serializers
 from timezone_field.rest_framework import TimeZoneSerializerField
 
 from core import models
-from core.models import ServiceProvider
 
 
 class ContactSerializer(serializers.ModelSerializer):
     """Serialize contacts."""
 
-    abilities = serializers.SerializerMethodField()
-
     class Meta:
         model = models.Contact
         fields = [
             "id",
-            "abilities",
-            "override",
+            "base",
             "data",
             "full_name",
-            "notes",
             "owner",
             "short_name",
         ]
-        read_only_fields = ["id", "owner", "abilities"]
-        extra_kwargs = {
-            "override": {"required": False},
-        }
+        read_only_fields = ["id", "owner"]
 
     def update(self, instance, validated_data):
-        """Make "override" field readonly but only for update/patch."""
-        validated_data.pop("override", None)
+        """Make "base" field readonly but only for update/patch."""
+        validated_data.pop("base", None)
         return super().update(instance, validated_data)
 
-    def get_abilities(self, contact) -> dict:
-        """Return abilities of the logged-in user on the instance."""
-        request = self.context.get("request")
-        if request:
-            return contact.get_abilities(request.user)
-        return {}
-
 
 class DynamicFieldsModelSerializer(serializers.ModelSerializer):
     """
@@ -49,8 +33,6 @@ class DynamicFieldsModelSerializer(serializers.ModelSerializer):
     """
 
     def __init__(self, *args, **kwargs):
-        """Pass arguments to superclass except 'fields', then drop fields not listed therein."""
-
         # Don't pass the 'fields' arg up to the superclass
         fields = kwargs.pop("fields", None)
 
@@ -65,89 +47,45 @@ class DynamicFieldsModelSerializer(serializers.ModelSerializer):
                 self.fields.pop(field_name)
 
 
-class OrganizationSerializer(serializers.ModelSerializer):
-    """Serialize organizations."""
-
-    abilities = serializers.SerializerMethodField()
-
-    class Meta:
-        model = models.Organization
-        fields = ["id", "name", "registration_id_list", "domain_list", "abilities"]
-        read_only_fields = ["id", "registration_id_list", "domain_list"]
-
-    def get_abilities(self, organization) -> dict:
-        """Return abilities of the logged-in user on the instance."""
-        request = self.context.get("request")
-        if request:
-            return organization.get_abilities(request.user)
-        return {}
-
-
-class UserOrganizationSerializer(serializers.ModelSerializer):
-    """Serialize organizations for users."""
-
-    class Meta:
-        model = models.Organization
-        fields = ["id", "name", "registration_id_list"]
-        read_only_fields = ["id", "name", "registration_id_list"]
-
-
 class UserSerializer(DynamicFieldsModelSerializer):
     """Serialize users."""
 
     timezone = TimeZoneSerializerField(use_pytz=False, required=True)
-    email = serializers.ReadOnlyField()
-    name = serializers.ReadOnlyField()
-    organization = UserOrganizationSerializer(read_only=True)
+    name = serializers.SerializerMethodField(read_only=True)
+    email = serializers.SerializerMethodField(read_only=True)
 
     class Meta:
         model = models.User
         fields = [
             "id",
+            "name",
             "email",
             "language",
-            "name",
-            "organization",
             "timezone",
             "is_device",
             "is_staff",
         ]
         read_only_fields = ["id", "name", "email", "is_device", "is_staff"]
 
+    def _get_main_identity_attr(self, obj, attribute_name):
+        """Return the specified attribute of the main identity."""
+        try:
+            return getattr(obj.main_identity[0], attribute_name)
+        except TypeError:
+            return getattr(obj.main_identity, attribute_name)
+        except IndexError:
+            main_identity = obj.identities.filter(is_main=True).first()
+            return getattr(obj.main_identity, attribute_name) if main_identity else None
+        except AttributeError:
+            return None
 
-class UserMeSerializer(UserSerializer):
-    """
-    Serialize the current user.
+    def get_name(self, obj):
+        """Return main identity's name."""
+        return self._get_main_identity_attr(obj, "name")
 
-    Same as the `UserSerializer` but with abilities.
-    """
-
-    abilities = serializers.SerializerMethodField()
-    organization = UserOrganizationSerializer(read_only=True)
-
-    class Meta:
-        model = models.User
-        fields = [
-            "email",
-            "id",
-            "is_device",
-            "is_staff",
-            "language",
-            "name",
-            "organization",
-            "timezone",
-            # added fields
-            "abilities",
-        ]
-        read_only_fields = ["id", "name", "email", "is_device", "is_staff"]
-
-    def get_abilities(self, user: models.User) -> dict:
-        """Return abilities of the logged-in user on the instance."""
-        if user != self.context["request"].user:  # Should not happen
-            raise RuntimeError(
-                "UserMeSerializer.get_abilities: user is not the same as the request user",
-            )
-        return user.get_abilities()
+    def get_email(self, obj):
+        """Return main identity's email."""
+        return self._get_main_identity_attr(obj, "email")
 
 
 class TeamAccessSerializer(serializers.ModelSerializer):
@@ -251,52 +189,28 @@ class TeamSerializer(serializers.ModelSerializer):
     """Serialize teams."""
 
     abilities = serializers.SerializerMethodField(read_only=True)
-    is_visible_all_services = serializers.BooleanField(required=False, default=True)
-    service_providers = serializers.PrimaryKeyRelatedField(
-        queryset=ServiceProvider.objects.all(), many=True, required=False
-    )
+    slug = serializers.SerializerMethodField()
 
     class Meta:
         model = models.Team
         fields = [
             "id",
-            "abilities",
-            "accesses",
-            "created_at",
-            "depth",
-            "is_visible_all_services",
             "name",
-            "numchild",
-            "path",
-            "service_providers",
+            "accesses",
+            "abilities",
+            "slug",
+            "created_at",
             "updated_at",
         ]
         read_only_fields = [
             "id",
-            "abilities",
             "accesses",
+            "abilities",
+            "slug",
             "created_at",
-            "depth",
-            "numchild",
-            "path",
             "updated_at",
         ]
 
-    def create(self, validated_data):
-        """Create a new team with organization enforcement."""
-        # When called as a resource server, we enforce the team service provider
-        if sp_audience := self.context.get("from_service_provider_audience", None):
-            service_provider, _created = models.ServiceProvider.objects.get_or_create(
-                audience_id=sp_audience
-            )
-            validated_data["service_providers"] = [service_provider]
-
-        # Note: this is not the purpose of this API to check the user has an organization
-        return super().create(
-            validated_data=validated_data
-            | {"organization_id": self.context["request"].user.organization_id}
-        )
-
     def get_abilities(self, team) -> dict:
         """Return abilities of the logged-in user on the instance."""
         request = self.context.get("request")
@@ -304,46 +218,15 @@ class TeamSerializer(serializers.ModelSerializer):
             return team.get_abilities(request.user)
         return {}
 
+    def get_slug(self, instance):
+        """Return slug from the team's name."""
+        return instance.get_slug()
+
 
 class InvitationSerializer(serializers.ModelSerializer):
     """Serialize invitations."""
 
     class Meta:
         model = models.Invitation
-        fields = ["id", "created_at", "email", "team", "role", "issuer", "is_expired"]
-        read_only_fields = ["id", "created_at", "team", "issuer", "is_expired"]
-
-    def validate(self, attrs):
-        """Validate and restrict invitation to new user based on email."""
-
-        request = self.context.get("request")
-        user = getattr(request, "user", None)
-
-        try:
-            team_id = self.context["team_id"]
-        except KeyError as exc:
-            raise exceptions.ValidationError(
-                "You must set a team ID in kwargs to create a new team invitation."
-            ) from exc
-
-        if not models.TeamAccess.objects.filter(
-            team=team_id,
-            user=user,
-            role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
-        ).exists():
-            raise exceptions.PermissionDenied(
-                "You are not allowed to manage invitation for this team."
-            )
-
-        attrs["team_id"] = team_id
-        attrs["issuer"] = user
-        return attrs
-
-
-class ServiceProviderSerializer(serializers.ModelSerializer):
-    """Serialize service providers."""
-
-    class Meta:
-        model = models.ServiceProvider
-        fields = ["id", "audience_id", "name"]
-        read_only_fields = ["id", "audience_id"]
+        fields = ["email", "team", "role", "issuer"]
+        read_only_fields = ["team", "issuer"]

src/backend/core/api/viewsets.py

@@ -0,0 +1,401 @@
+"""API endpoints"""
+from django.contrib.postgres.search import TrigramSimilarity
+from django.db.models import Func, Max, OuterRef, Prefetch, Q, Subquery, Value
+
+from rest_framework import (
+    decorators,
+    exceptions,
+    filters,
+    mixins,
+    pagination,
+    response,
+    viewsets,
+)
+from rest_framework.throttling import UserRateThrottle
+
+from core import models
+
+from . import permissions, serializers
+
+EMAIL_SIMILARITY_THRESHOLD = 0.01
+# TrigramSimilarity threshold is lower for searching email than for names,
+# to improve matching results
+
+
+class NestedGenericViewSet(viewsets.GenericViewSet):
+    """
+    A generic Viewset aims to be used in a nested route context.
+    e.g: `/api/v1.0/resource_1/<resource_1_pk>/resource_2/<resource_2_pk>/`
+
+    It allows to define all url kwargs and lookup fields to perform the lookup.
+    """
+
+    lookup_fields: list[str] = ["pk"]
+    lookup_url_kwargs: list[str] = []
+
+    def __getattribute__(self, item):
+        """
+        This method is overridden to allow to get the last lookup field or lookup url kwarg
+        when accessing the `lookup_field` or `lookup_url_kwarg` attribute. This is useful
+        to keep compatibility with all methods used by the parent class `GenericViewSet`.
+        """
+        if item in ["lookup_field", "lookup_url_kwarg"]:
+            return getattr(self, item + "s", [None])[-1]
+
+        return super().__getattribute__(item)
+
+    def get_queryset(self):
+        """
+        Get the list of items for this view.
+
+        `lookup_fields` attribute is enumerated here to perform the nested lookup.
+        """
+        queryset = super().get_queryset()
+
+        # The last lookup field is removed to perform the nested lookup as it corresponds
+        # to the object pk, it is used within get_object method.
+        lookup_url_kwargs = (
+            self.lookup_url_kwargs[:-1]
+            if self.lookup_url_kwargs
+            else self.lookup_fields[:-1]
+        )
+
+        filter_kwargs = {}
+        for index, lookup_url_kwarg in enumerate(lookup_url_kwargs):
+            if lookup_url_kwarg not in self.kwargs:
+                raise KeyError(
+                    f"Expected view {self.__class__.__name__} to be called with a URL "
+                    f'keyword argument named "{lookup_url_kwarg}". Fix your URL conf, or '
+                    "set the `.lookup_fields` attribute on the view correctly."
+                )
+
+            filter_kwargs.update(
+                {self.lookup_fields[index]: self.kwargs[lookup_url_kwarg]}
+            )
+
+        return queryset.filter(**filter_kwargs)
+
+
+class SerializerPerActionMixin:
+    """
+    A mixin to allow to define serializer classes for each action.
+
+    This mixin is useful to avoid to define a serializer class for each action in the
+    `get_serializer_class` method.
+    """
+
+    serializer_classes: dict[str, type] = {}
+    default_serializer_class: type = None
+
+    def get_serializer_class(self):
+        """
+        Return the serializer class to use depending on the action.
+        """
+        return self.serializer_classes.get(self.action, self.default_serializer_class)
+
+
+class Pagination(pagination.PageNumberPagination):
+    """Pagination to display no more than 100 objects per page sorted by creation date."""
+
+    ordering = "-created_on"
+    max_page_size = 100
+    page_size_query_param = "page_size"
+
+
+class BurstRateThrottle(UserRateThrottle):
+    """
+    Throttle rate for minutes. See DRF section in settings for default value.
+    """
+
+    scope = "burst"
+
+
+class SustainedRateThrottle(UserRateThrottle):
+    """
+    Throttle rate for hours. See DRF section in settings for default value.
+    """
+
+    scope = "sustained"
+
+
+# pylint: disable=too-many-ancestors
+class ContactViewSet(
+    mixins.CreateModelMixin,
+    mixins.DestroyModelMixin,
+    mixins.RetrieveModelMixin,
+    mixins.UpdateModelMixin,
+    viewsets.GenericViewSet,
+):
+    """Contact ViewSet"""
+
+    permission_classes = [permissions.IsOwnedOrPublic]
+    queryset = models.Contact.objects.all()
+    serializer_class = serializers.ContactSerializer
+    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
+
+    def list(self, request, *args, **kwargs):
+        """Limit listed users by a query with throttle protection."""
+        user = self.request.user
+        queryset = self.filter_queryset(self.get_queryset())
+
+        # Exclude contacts that:
+        queryset = queryset.filter(
+            # - belong to another user (keep public and owned contacts)
+            Q(owner__isnull=True) | Q(owner=user),
+            # - are profile contacts for a user
+            user__isnull=True,
+            # - are overriden base contacts
+            overriding_contacts__isnull=True,
+        )
+
+        # Search by case-insensitive and accent-insensitive trigram similarity
+        if query := self.request.GET.get("q", ""):
+            query = Func(Value(query), function="unaccent")
+            similarity = TrigramSimilarity(
+                Func("full_name", function="unaccent"),
+                query,
+            ) + TrigramSimilarity(Func("short_name", function="unaccent"), query)
+            queryset = (
+                queryset.annotate(similarity=similarity)
+                .filter(
+                    similarity__gte=0.05
+                )  # Value determined by testing (test_api_contacts.py)
+                .order_by("-similarity")
+            )
+
+        serializer = self.get_serializer(queryset, many=True)
+        return response.Response(serializer.data)
+
+    def perform_create(self, serializer):
+        """Set the current user as owner of the newly created contact."""
+        user = self.request.user
+        serializer.validated_data["owner"] = user
+        return super().perform_create(serializer)
+
+
+class UserViewSet(
+    mixins.UpdateModelMixin, viewsets.GenericViewSet, mixins.ListModelMixin
+):
+    """
+    User viewset for all interactions with user infos and teams.
+
+    GET /api/users/&q=query
+        Return a list of users whose email matches the query. Similarity is
+        calculated using trigram similarity, allowing for partial,
+        case-insensitive matches and accented queries.
+    """
+
+    permission_classes = [permissions.IsSelf]
+    queryset = models.User.objects.all()
+    serializer_class = serializers.UserSerializer
+    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
+    pagination_class = Pagination
+
+    def get_queryset(self):
+        """Limit listed users by a query. Pagination and throttle protection apply."""
+        queryset = self.queryset
+
+        if self.action == "list":
+            # Exclude inactive contacts
+            queryset = queryset.filter(
+                is_active=True,
+            ).prefetch_related(
+                Prefetch(
+                    "identities",
+                    queryset=models.Identity.objects.filter(is_main=True),
+                    to_attr="main_identity",
+                )
+            )
+
+            # Search by case-insensitive and accent-insensitive trigram similarity
+            if query := self.request.GET.get("q", ""):
+                similarity = Max(
+                    TrigramSimilarity(
+                        Func("identities__email", function="unaccent"),
+                        Func(Value(query), function="unaccent"),
+                    )
+                )
+                queryset = (
+                    queryset.annotate(similarity=similarity)
+                    .filter(similarity__gte=EMAIL_SIMILARITY_THRESHOLD)
+                    .order_by("-similarity")
+                )
+
+        return queryset
+
+    @decorators.action(
+        detail=False,
+        methods=["get"],
+        url_name="me",
+        url_path="me",
+    )
+    def get_me(self, request):
+        """
+        Return information on currently logged user
+        """
+        user = request.user
+        user.main_identity = models.Identity.objects.filter(
+            user=user, is_main=True
+        ).first()
+        return response.Response(
+            self.serializer_class(user, context={"request": request}).data
+        )
+
+
+class TeamViewSet(
+    mixins.CreateModelMixin,
+    mixins.DestroyModelMixin,
+    mixins.ListModelMixin,
+    mixins.RetrieveModelMixin,
+    mixins.UpdateModelMixin,
+    viewsets.GenericViewSet,
+):
+    """Team ViewSet"""
+
+    permission_classes = [permissions.AccessPermission]
+    serializer_class = serializers.TeamSerializer
+    filter_backends = [filters.OrderingFilter]
+    ordering_fields = ["created_at"]
+    ordering = ["-created_at"]
+    queryset = models.Team.objects.all()
+
+    def get_queryset(self):
+        """Custom queryset to get user related teams."""
+        user_role_query = models.TeamAccess.objects.filter(
+            user=self.request.user, team=OuterRef("pk")
+        ).values("role")[:1]
+        return models.Team.objects.filter(accesses__user=self.request.user).annotate(
+            user_role=Subquery(user_role_query)
+        )
+
+    def perform_create(self, serializer):
+        """Set the current user as owner of the newly created team."""
+        team = serializer.save()
+        models.TeamAccess.objects.create(
+            team=team,
+            user=self.request.user,
+            role=models.RoleChoices.OWNER,
+        )
+
+
+class TeamAccessViewSet(
+    mixins.CreateModelMixin,
+    mixins.DestroyModelMixin,
+    mixins.ListModelMixin,
+    mixins.RetrieveModelMixin,
+    mixins.UpdateModelMixin,
+    viewsets.GenericViewSet,
+):
+    """
+    API ViewSet for all interactions with team accesses.
+
+    GET /api/v1.0/teams/<team_id>/accesses/:<team_access_id>
+        Return list of all team accesses related to the logged-in user or one
+        team access if an id is provided.
+
+    POST /api/v1.0/teams/<team_id>/accesses/ with expected data:
+        - user: str
+        - role: str [owner|admin|member]
+        Return newly created team access
+
+    PUT /api/v1.0/teams/<team_id>/accesses/<team_access_id>/ with expected data:
+        - role: str [owner|admin|member]
+        Return updated team access
+
+    PATCH /api/v1.0/teams/<team_id>/accesses/<team_access_id>/ with expected data:
+        - role: str [owner|admin|member]
+        Return partially updated team access
+
+    DELETE /api/v1.0/teams/<team_id>/accesses/<team_access_id>/
+        Delete targeted team access
+    """
+
+    lookup_field = "pk"
+    pagination_class = Pagination
+    permission_classes = [permissions.AccessPermission]
+    queryset = models.TeamAccess.objects.all().select_related("user")
+    list_serializer_class = serializers.TeamAccessReadOnlySerializer
+    detail_serializer_class = serializers.TeamAccessSerializer
+
+    def get_permissions(self):
+        """User only needs to be authenticated to list team accesses"""
+        if self.action == "list":
+            permission_classes = [permissions.IsAuthenticated]
+        else:
+            return super().get_permissions()
+
+        return [permission() for permission in permission_classes]
+
+    def get_serializer_context(self):
+        """Extra context provided to the serializer class."""
+        context = super().get_serializer_context()
+        context["team_id"] = self.kwargs["team_id"]
+        return context
+
+    def get_serializer_class(self):
+        if self.action in {"list", "retrieve"}:
+            return self.list_serializer_class
+        return self.detail_serializer_class
+
+    def get_queryset(self):
+        """Return the queryset according to the action."""
+        queryset = super().get_queryset()
+        queryset = queryset.filter(team=self.kwargs["team_id"])
+
+        if self.action in {"list", "retrieve"}:
+            # Limit to team access instances related to a team THAT also has a team access
+            # instance for the logged-in user (we don't want to list only the team access
+            # instances pointing to the logged-in user)
+            user_role_query = models.TeamAccess.objects.filter(
+                team__accesses__user=self.request.user
+            ).values("role")[:1]
+
+            queryset = (
+                queryset.filter(
+                    team__accesses__user=self.request.user,
+                )
+                .prefetch_related(
+                    Prefetch(
+                        "user__identities",
+                        queryset=models.Identity.objects.filter(is_main=True),
+                        to_attr="main_identity",
+                    )
+                )
+                .annotate(user_role=Subquery(user_role_query))
+                .distinct()
+            )
+        return queryset
+
+    def destroy(self, request, *args, **kwargs):
+        """Forbid deleting the last owner access"""
+        instance = self.get_object()
+        team = instance.team
+
+        # Check if the access being deleted is the last owner access for the team
+        if instance.role == "owner" and team.accesses.filter(role="owner").count() == 1:
+            return response.Response(
+                {"detail": "Cannot delete the last owner access for the team."},
+                status=400,
+            )
+
+        return super().destroy(request, *args, **kwargs)
+
+    def perform_update(self, serializer):
+        """Check that we don't change the role if it leads to losing the last owner."""
+        instance = serializer.instance
+
+        # Check if the role is being updated and the new role is not "owner"
+        if (
+            "role" in self.request.data
+            and self.request.data["role"] != models.RoleChoices.OWNER
+        ):
+            team = instance.team
+            # Check if the access being updated is the last owner access for the team
+            if (
+                instance.role == models.RoleChoices.OWNER
+                and team.accesses.filter(role=models.RoleChoices.OWNER).count() == 1
+            ):
+                message = "Cannot change the role to a non-owner role for the last owner access."
+                raise exceptions.ValidationError({"role": message})
+
+        serializer.save()

src/backend/core/apps.py

@@ -1,69 +1,11 @@
 """People Core application"""
-
-import logging
-
-from django.apps import AppConfig
-from django.conf import settings
-from django.core.management import call_command, get_commands
-from django.utils.translation import gettext_lazy as _
-
-from core.utils.io import TeeStringIO
-
-from people.celery_app import app as celery_app
-
-logger = logging.getLogger(__name__)
+# from django.apps import AppConfig
+# from django.utils.translation import gettext_lazy as _
 
 
-def _register_management_commands_as_task():
-    """
-    Register management command which are enabled via MANAGEMENT_COMMAND_AS_TASK setting.
-    """
-    for command_name in settings.MANAGEMENT_COMMAND_AS_TASK:
-        # Check if the command is a valid management command
-        try:
-            app_name = get_commands()[command_name]
-        except KeyError:
-            logging.error("Command %s is not a valid management command.", command_name)
-            continue
+# class CoreConfig(AppConfig):
+#     """Configuration class for the People core app."""
 
-        command_full_name = ".".join([app_name, command_name])
-
-        # Create a closure to capture the current value of command_full_name and command_name
-        def create_task(cmd_name, cmd_full_name):
-            @celery_app.task(name=cmd_full_name)
-            def task_wrapper(*command_args, **command_options):
-                stdout = TeeStringIO(logging.getLogger(cmd_full_name).info)
-                stderr = TeeStringIO(logging.getLogger(cmd_full_name).error)
-
-                call_command(
-                    cmd_name,
-                    *command_args,
-                    no_color=True,
-                    stdout=stdout,
-                    stderr=stderr,
-                    **command_options,
-                )
-
-                stdout.seek(0)
-                stderr.seek(0)
-                return {
-                    "stdout": str(stdout.read()),
-                    "stderr": str(stderr.read()),
-                }
-
-            return task_wrapper
-
-        # Create the task with the current values
-        create_task(command_name, command_full_name)
-
-
-class CoreConfig(AppConfig):
-    """Configuration class for the People core app."""
-
-    name = "core"
-    app_label = "core"
-    verbose_name = _("People core application")
-
-    def ready(self):
-        """Run when the application is ready."""
-        _register_management_commands_as_task()
+#     name = "core"
+#     app_label = "core"
+#     verbose_name = _("People core application")

src/backend/core/authentication.py

@@ -0,0 +1,121 @@
+"""Authentication for the People core app."""
+from django.conf import settings
+from django.core.exceptions import SuspiciousOperation
+from django.db import models
+from django.utils.translation import gettext_lazy as _
+
+import requests
+from mozilla_django_oidc.auth import (
+    OIDCAuthenticationBackend as MozillaOIDCAuthenticationBackend,
+)
+
+from .models import Identity
+
+
+class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend):
+    """Custom OpenID Connect (OIDC) Authentication Backend.
+
+    This class overrides the default OIDC Authentication Backend to accommodate differences
+    in the User and Identity models, and handles signed and/or encrypted UserInfo response.
+    """
+
+    def get_userinfo(self, access_token, id_token, payload):
+        """Return user details dictionary.
+
+        Parameters:
+        - access_token (str): The access token.
+        - id_token (str): The id token (unused).
+        - payload (dict): The token payload (unused).
+
+        Note: The id_token and payload parameters are unused in this implementation,
+        but were kept to preserve base method signature.
+
+        Note: It handles signed and/or encrypted UserInfo Response. It is required by
+        Agent Connect, which follows the OIDC standard. It forces us to override the
+        base method, which deal with 'application/json' response.
+
+        Returns:
+        - dict: User details dictionary obtained from the OpenID Connect user endpoint.
+        """
+
+        user_response = requests.get(
+            self.OIDC_OP_USER_ENDPOINT,
+            headers={"Authorization": f"Bearer {access_token}"},
+            verify=self.get_settings("OIDC_VERIFY_SSL", True),
+            timeout=self.get_settings("OIDC_TIMEOUT", None),
+            proxies=self.get_settings("OIDC_PROXY", None),
+        )
+        user_response.raise_for_status()
+        userinfo = self.verify_token(user_response.text)
+        return userinfo
+
+    def get_or_create_user(self, access_token, id_token, payload):
+        """Return a User based on userinfo. Get or create a new user if no user matches the Sub.
+
+        Parameters:
+        - access_token (str): The access token.
+        - id_token (str): The ID token.
+        - payload (dict): The user payload.
+
+        Returns:
+        - User: An existing or newly created User instance.
+
+        Raises:
+        - Exception: Raised when user creation is not allowed and no existing user is found.
+        """
+
+        user_info = self.get_userinfo(access_token, id_token, payload)
+
+        # Compute user name from OIDC name fields as defined in settings
+        names_list = [
+            user_info[field]
+            for field in settings.USER_OIDC_FIELDS_TO_NAME
+            if user_info.get(field)
+        ]
+        user_info["name"] = " ".join(names_list) or None
+
+        sub = user_info.get("sub")
+        if sub is None:
+            raise SuspiciousOperation(
+                _("User info contained no recognizable user identification")
+            )
+
+        user = (
+            self.UserModel.objects.filter(identities__sub=sub)
+            .annotate(
+                identity_email=models.F("identities__email"),
+                identity_name=models.F("identities__name"),
+            )
+            .distinct()
+            .first()
+        )
+        if user:
+            email = user_info.get("email")
+            name = user_info.get("name")
+            if (
+                email
+                and email != user.identity_email
+                or name
+                and name != user.identity_name
+            ):
+                Identity.objects.filter(sub=sub).update(email=email, name=name)
+
+        elif self.get_settings("OIDC_CREATE_USER", True):
+            user = self.create_user(user_info)
+
+        return user
+
+    def create_user(self, claims):
+        """Return a newly created User instance."""
+        sub = claims.get("sub")
+        if sub is None:
+            raise SuspiciousOperation(
+                _("Claims contained no recognizable user identification")
+            )
+
+        user = self.UserModel.objects.create(password="!")  # noqa: S106
+        Identity.objects.create(
+            user=user, sub=sub, email=claims.get("email"), name=claims.get("name")
+        )
+
+        return user

src/backend/core/authentication/__init__.py

@@ -1 +0,0 @@
-"""Authentication module."""

src/backend/core/authentication/backends.py

@@ -1,186 +0,0 @@
-"""Authentication Backends for the People core app."""
-
-import logging
-
-from django.conf import settings
-from django.core.exceptions import SuspiciousOperation
-from django.utils.translation import gettext_lazy as _
-
-from lasuite.oidc_login.backends import (
-    OIDCAuthenticationBackend as LaSuiteOIDCAuthenticationBackend,
-)
-from lasuite.tools.email import get_domain_from_email
-from rest_framework.authentication import BaseAuthentication
-from rest_framework.exceptions import AuthenticationFailed
-
-from core.models import (
-    AccountService,
-    Contact,
-    Organization,
-)
-
-logger = logging.getLogger(__name__)
-
-
-class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
-    """Custom OpenID Connect (OIDC) Authentication Backend.
-
-    This class overrides the default OIDC Authentication Backend to accommodate differences
-    in the User model, and handles signed and/or encrypted UserInfo response.
-    """
-
-    def get_extra_claims(self, user_info):
-        """
-        Return extra claims from user_info.
-
-        Args:
-          user_info (dict): The user information dictionary.
-
-        Returns:
-          dict: A dictionary of extra claims.
-
-        """
-        extra_claims = super().get_extra_claims(user_info)
-        if settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD:
-            extra_claims[settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD] = (
-                user_info.get(settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD)
-            )
-        return extra_claims
-
-    def post_get_or_create_user(self, user, claims, is_new_user):
-        """
-        Post-processing after user creation or retrieval.
-
-        Args:
-          user (User): The user instance.
-          claims (dict): The claims dictionary.
-          is_new_user (bool): Indicates if the user was newly created.
-
-        Returns:
-        - None
-
-        """
-        # Data cleaning, to be removed when user organization is null=False
-        # or all users have an organization.
-        # See https://github.com/suitenumerique/people/issues/504
-        if not user.organization_id:
-            organization_registration_id = claims.get(
-                settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD
-            )
-            domain = get_domain_from_email(claims["email"])
-            try:
-                organization, organization_created = (
-                    Organization.objects.get_or_create_from_user_claims(
-                        registration_id=organization_registration_id,
-                        domain=domain,
-                    )
-                )
-                if organization_created:
-                    logger.info("Organization %s created", organization)
-                    # For this case, we don't create an OrganizationAccess we will
-                    # manage this manually later, because we don't want the first
-                    # user who log in after the release to be the admin of their
-                    # organization. We will keep organization without admin, and
-                    # we will have to manually clean things up (while there is
-                    # not that much organization in the database).
-            except ValueError as exc:
-                # Raised when there is no recognizable organization
-                # identifier (domain or registration_id)
-                logger.warning("Unable to update user organization: %s", exc)
-            else:
-                user.organization = organization
-                user.save()
-                logger.info(
-                    "User %s updated with organization %s", user.pk, organization
-                )
-
-    def create_user(self, claims):
-        """Return a newly created User instance."""
-        sub = claims.get("sub")
-        if sub is None:
-            raise SuspiciousOperation(
-                _("Claims contained no recognizable user identification")
-            )
-        email = claims.get("email")
-        name = claims.get("name")
-
-        # Extract or create the organization from the data
-        organization_registration_id = claims.pop(
-            settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD,
-            None,
-        )
-        domain = get_domain_from_email(email)
-        try:
-            organization, organization_created = (
-                Organization.objects.get_or_create_from_user_claims(
-                    registration_id=organization_registration_id,
-                    domain=domain,
-                )
-            )
-        except ValueError as exc:
-            raise SuspiciousOperation(
-                _("Claims contained no recognizable organization identification")
-            ) from exc
-
-        if organization_created:
-            logger.info("Organization %s created", organization)
-
-        logger.info("Creating user %s / %s", sub, email)
-
-        user = super().create_user(claims | {"organization": organization})
-
-        # Initiate the user's profile
-        Contact.objects.create(
-            owner=user,
-            user=user,
-            full_name=name or email,
-            data={
-                "emails": [
-                    {"type": "Work", "value": email},
-                ],
-            },
-        )
-
-        return user
-
-
-class AccountServiceAuthentication(BaseAuthentication):
-    """Authentication backend for account services using Authorization header.
-    The Authorization header is used to authenticate the request.
-    The api key is stored in the AccountService model.
-
-    Header format:
-        Authorization: ApiKey <api_key>
-    """
-
-    def authenticate(self, request):
-        """Authenticate the request. Find the account service and check the api key.
-
-        Should return either:
-        - a tuple of (account_service, api_key) if allowed,
-        - None to pass on other authentication backends
-        - raise an AuthenticationFailed exception to stop propagation.
-        """
-        auth_header = request.headers.get("Authorization", "")
-        if not auth_header:
-            return None
-        try:
-            auth_mode, api_key = auth_header.split(" ")
-        except (IndexError, ValueError) as err:
-            raise AuthenticationFailed(_("Invalid authorization header.")) from err
-        if auth_mode.lower() != "apikey" or not api_key:
-            raise AuthenticationFailed(_("Invalid authorization header."))
-        try:
-            account_service = AccountService.objects.get(api_key=api_key)
-        except AccountService.DoesNotExist as err:
-            logger.warning("Invalid api_key: %s", api_key)
-            raise AuthenticationFailed(_("Invalid api key.")) from err
-        return (account_service, account_service.api_key)
-
-    def authenticate_header(self, request):
-        """
-        Return a string to be used as the value of the `WWW-Authenticate`
-        header in a `401 Unauthenticated` response, or `None` if the
-        authentication scheme should return `403 Permission Denied` responses.
-        """
-        return "apikey"

src/backend/core/enums.py

@@ -1,10 +1,7 @@
-# pylint: disable=too-many-ancestors
 """
 Core application enums declaration
 """
-
 from django.conf import global_settings, settings
-from django.db import models
 from django.utils.translation import gettext_lazy as _
 
 # Django sets `LANGUAGES` by default with all supported languages. We can use it for
@@ -16,18 +13,3 @@ ALL_LANGUAGES = getattr(
     "ALL_LANGUAGES",
     [(language, _(name)) for language, name in global_settings.LANGUAGES],
 )
-
-
-class WebhookStatusChoices(models.TextChoices):
-    """Defines the possible statuses in which a webhook can be."""
-
-    FAILURE = "failure", _("Failure")
-    PENDING = "pending", _("Pending")
-    SUCCESS = "success", _("Success")
-
-
-class WebhookProtocolChoices(models.TextChoices):
-    """Defines the possible protocols of webhook."""
-
-    SCIM = "scim"
-    MATRIX = "matrix"

src/backend/core/exceptions.py

@@ -1,18 +0,0 @@
-"""
-Custom exceptions for mailbox manager app
-"""
-
-from django.utils.translation import gettext_lazy as _
-
-from rest_framework import status
-from rest_framework.exceptions import APIException
-
-
-class EmailAlreadyKnownException(APIException):
-    """Exception raised when trying to create a user with an already existing email address."""
-
-    status_code = status.HTTP_201_CREATED
-    default_detail = _(
-        "Email already known. Invitation not sent but access created instead."
-    )
-    default_code = "email already known"

src/backend/core/factories.py

@@ -1,7 +1,7 @@
+# ruff: noqa: S311
 """
 Core application factories
 """
-
 from django.conf import settings
 from django.contrib.auth.hashers import make_password
 
@@ -114,83 +114,32 @@ class ContactFactory(BaseContactFactory):
     class Meta:
         model = models.Contact
 
-    owner = factory.SubFactory("core.factories.UserFactory")
-
-
-class ProfileContactFactory(BaseContactFactory):
-    """A factory to create profile contacts for a user"""
-
-    class Meta:
-        model = models.Contact
-
-    owner = factory.SelfAttribute(".user")
-    user = factory.SubFactory("core.factories.UserFactory")
-
-
-class OverrideContactFactory(BaseContactFactory):
-    """A factory to create contacts for a user"""
-
-    class Meta:
-        model = models.Contact
-
-    override = factory.SubFactory("core.factories.ContactFactory", owner=None)
-    owner = factory.SubFactory("core.factories.UserFactory")
-
-
-class OrganizationFactory(factory.django.DjangoModelFactory):
-    """Factory to create organizations for testing purposes."""
-
-    name = factory.Faker("company")
-
-    class Meta:
-        model = models.Organization
-
-    class Params:  # pylint: disable=missing-class-docstring
-        with_registration_id = factory.Trait(
-            registration_id_list=factory.List(
-                [factory.Sequence(lambda n: f"{n:014d}")]
-            ),
-        )
-        with_domain = factory.Trait(
-            domain_list=factory.List([factory.Faker("domain_name")]),
-        )
-
-
-class OrganizationAccessFactory(factory.django.DjangoModelFactory):
-    """Factory to create organization accesses for testing purposes."""
-
-    class Meta:
-        model = models.OrganizationAccess
-
-    user = factory.SubFactory(
-        "core.factories.UserFactory",
-        organization=factory.SelfAttribute("..organization"),
-    )
-    organization = factory.SubFactory(
-        "core.factories.OrganizationFactory", with_registration_id=True
-    )
-    role = factory.fuzzy.FuzzyChoice(models.OrganizationRoleChoices.values)
+    base = factory.SubFactory("core.factories.ContactFactory", base=None, owner=None)
+    owner = factory.SubFactory("core.factories.UserFactory", profile_contact=None)
 
 
 class UserFactory(factory.django.DjangoModelFactory):
-    """A factory to create random users for testing purposes."""
+    """A factory to random users for testing purposes."""
 
     class Meta:
         model = models.User
+
+    email = factory.Faker("email")
+    language = factory.fuzzy.FuzzyChoice([lang[0] for lang in settings.LANGUAGES])
+    password = make_password("password")
+
+
+class IdentityFactory(factory.django.DjangoModelFactory):
+    """A factory to create identities for a user"""
+
+    class Meta:
+        model = models.Identity
         django_get_or_create = ("sub",)
 
-    class Params:
-        with_organization = factory.Trait(
-            organization=factory.SubFactory(
-                OrganizationFactory, with_registration_id=True
-            ),
-        )
-
+    user = factory.SubFactory(UserFactory)
     sub = factory.Sequence(lambda n: f"user{n!s}")
     email = factory.Faker("email")
     name = factory.Faker("name")
-    language = factory.fuzzy.FuzzyChoice([lang[0] for lang in settings.LANGUAGES])
-    password = make_password("password")
 
 
 class TeamFactory(factory.django.DjangoModelFactory):
@@ -198,27 +147,19 @@ class TeamFactory(factory.django.DjangoModelFactory):
 
     class Meta:
         model = models.Team
-        skip_postgeneration_save = True
+        django_get_or_create = ("name",)
 
     name = factory.Sequence(lambda n: f"team{n}")
 
     @factory.post_generation
     def users(self, create, extracted, **kwargs):
         """Add users to team from a given list of users with or without roles."""
-        if not create or not extracted:
-            return
-        for user_entry in extracted:
-            if isinstance(user_entry, models.User):
-                TeamAccessFactory(team=self, user=user_entry)
-            else:
-                TeamAccessFactory(team=self, user=user_entry[0], role=user_entry[1])
-
-    @factory.post_generation
-    def service_providers(self, create, extracted, **kwargs):
-        """Add service providers to team from a given list of service providers."""
-        if not create or not extracted:
-            return
-        self.service_providers.set(extracted)
+        if create and extracted:
+            for item in extracted:
+                if isinstance(item, models.User):
+                    TeamAccessFactory(team=self, user=item)
+                else:
+                    TeamAccessFactory(team=self, user=item[0], role=item[1])
 
 
 class TeamAccessFactory(factory.django.DjangoModelFactory):
@@ -232,57 +173,13 @@ class TeamAccessFactory(factory.django.DjangoModelFactory):
     role = factory.fuzzy.FuzzyChoice([r[0] for r in models.RoleChoices.choices])
 
 
-class TeamWebhookFactory(factory.django.DjangoModelFactory):
-    """Create fake team webhooks for testing."""
-
-    class Meta:
-        model = models.TeamWebhook
-
-    team = factory.SubFactory(TeamFactory)
-    url = factory.Sequence(lambda n: f"https://nosuchdomain.xyz/Groups/{n!s}")
-
-
 class InvitationFactory(factory.django.DjangoModelFactory):
     """A factory to create invitations for a user"""
 
     class Meta:
         model = models.Invitation
 
-    team = factory.SubFactory(TeamFactory)
     email = factory.Faker("email")
+    team = factory.SubFactory(TeamFactory)
     role = factory.fuzzy.FuzzyChoice([role[0] for role in models.RoleChoices.choices])
     issuer = factory.SubFactory(UserFactory)
-
-
-class ServiceProviderFactory(factory.django.DjangoModelFactory):
-    """A factory to create service providers for testing purposes."""
-
-    class Meta:
-        model = models.ServiceProvider
-        skip_postgeneration_save = True
-
-    audience_id = factory.Faker("uuid4")
-
-    @factory.post_generation
-    def teams(self, create, extracted, **kwargs):
-        """Add teams to service provider from a given list."""
-        if not create or not extracted:
-            return
-        self.teams.set(extracted)
-
-    @factory.post_generation
-    def organizations(self, create, extracted, **kwargs):
-        """Add organization to service provider from a given list."""
-        if not create or not extracted:
-            return
-        self.organizations.set(extracted)
-
-
-class AccountServiceFactory(factory.django.DjangoModelFactory):
-    """A factory to create account services for testing purposes."""
-
-    class Meta:
-        model = models.AccountService
-
-    name = factory.Sequence(lambda n: f"Account Service {n!s}")
-    api_key = factory.Faker("uuid4")

src/backend/core/jsonschema/fr/organization_metadata.json

@@ -1,15 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "type": "object",
-  "title": "Organization Metadata",
-  "properties": {
-    "is_public_service": {
-      "type": "boolean",
-      "title": "Is public service"
-    },
-    "is_commune": {
-      "type": "boolean",
-      "title": "Is commune"
-    }
-  }
-}

src/backend/core/management/__init__.py

@@ -1 +0,0 @@
-"""Management commands for core app."""

src/backend/core/management/commands/__init__.py

@@ -1 +0,0 @@
-"""Management commands for core app."""

src/backend/core/management/commands/fill_organization_metadata.py

@@ -1,34 +0,0 @@
-"""
-Management command for filling organization metadata with default values.
-"""
-
-from django.core.management.base import BaseCommand
-
-from core import models
-from core.utils.json_schema import generate_default_from_schema
-
-
-class Command(BaseCommand):
-    """Management command to fill organization metadata with default values."""
-
-    help = "Fill organization metadata with default values"
-
-    def handle(self, *args, **options):
-        """Fill organizations metadata missing values with default values."""
-        organization_metadata_schema = models.get_organization_metadata_schema()
-
-        if not organization_metadata_schema:
-            message = "No organization metadata schema defined."
-            self.stdout.write(self.style.ERROR(message))
-            return
-
-        default_metadata = generate_default_from_schema(organization_metadata_schema)
-        for organization in models.Organization.objects.all():
-            organization.metadata = {**default_metadata, **organization.metadata}
-
-            # Save the organization with the updated metadata
-            # We don't use bulk update because we want to trigger the clean method
-            organization.save(update_fields=["metadata", "updated_at"])
-
-        message = "Organization metadata filled with default values."
-        self.stdout.write(self.style.SUCCESS(message))

src/backend/core/management/commands/list_plugins.py

@@ -1,22 +0,0 @@
-"""Management command to list all plugins and their hooks."""
-
-from django.conf import settings
-from django.core.management.base import BaseCommand
-
-from core.plugins.registry import registry
-
-
-class Command(BaseCommand):
-    """Management command to list all plugins and their hooks."""
-
-    help = "List all plugins and their hooks"
-
-    def handle(self, *args, **options):
-        """Print plugin information."""
-        self.stdout.write(self.style.NOTICE("# Listing plugins\n"))
-        for plugin_app in settings.INSTALLED_PLUGINS:
-            self.stdout.write(self.style.NOTICE(f" - {plugin_app}\n"))
-
-        self.stdout.write(self.style.NOTICE("# Listing loaded hooks\n"))
-        for hook_name, callbacks in registry.get_registered_hooks():
-            self.stdout.write(self.style.NOTICE(f" - {hook_name}: {callbacks}\n"))

src/backend/core/migrations/0001_initial.py

@@ -1,4 +1,4 @@
-# Generated by Django 5.0.3 on 2024-06-08 09:25
+# Generated by Django 5.0.2 on 2024-02-23 06:46
 
 import django.contrib.auth.models
 import django.core.validators
@@ -45,10 +45,8 @@ class Migration(migrations.Migration):
                 ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                 ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
                 ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('sub', models.CharField(help_text='Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
-                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='email address')),
-                ('name', models.CharField(blank=True, max_length=100, null=True, verbose_name='name')),
-                ('language', models.CharField(choices=settings.LANGUAGES, default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
+                ('email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='email address')),
+                ('language', models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
                 ('timezone', timezone_field.fields.TimeZoneField(choices_display='WITH_GMT_OFFSET', default='UTC', help_text='The timezone in which the user wants to see times.', use_pytz=False)),
                 ('is_device', models.BooleanField(default=False, help_text='Whether the user is a device or a real user.', verbose_name='device')),
                 ('is_staff', models.BooleanField(default=False, help_text='Whether the user can log into this admin site.', verbose_name='staff status')),
@@ -89,6 +87,25 @@ class Migration(migrations.Migration):
             name='profile_contact',
             field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='user', to='core.contact'),
         ),
+        migrations.CreateModel(
+            name='Identity',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
+                ('sub', models.CharField(help_text='Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
+                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='email address')),
+                ('name', models.CharField(blank=True, max_length=100, null=True, verbose_name='name')),
+                ('is_main', models.BooleanField(default=False, help_text='Designates whether the email is the main one.', verbose_name='main')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='identities', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'verbose_name': 'identity',
+                'verbose_name_plural': 'identities',
+                'db_table': 'people_identity',
+                'ordering': ('-is_main', 'email'),
+            },
+        ),
         migrations.CreateModel(
             name='Invitation',
             fields=[
@@ -101,9 +118,7 @@ class Migration(migrations.Migration):
                 ('team', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='invitations', to='core.team')),
             ],
             options={
-                'verbose_name': 'Team invitation',
-                'verbose_name_plural': 'Team invitations',
-                'db_table': 'people_invitation',
+                'abstract': False,
             },
         ),
         migrations.CreateModel(
@@ -127,38 +142,21 @@ class Migration(migrations.Migration):
             name='users',
             field=models.ManyToManyField(related_name='teams', through='core.TeamAccess', to=settings.AUTH_USER_MODEL),
         ),
-        migrations.CreateModel(
-            name='TeamWebhook',
-            fields=[
-                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
-                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
-                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('url', models.URLField(verbose_name='url')),
-                ('secret', models.CharField(blank=True, max_length=255, null=True, verbose_name='secret')),
-                ('status', models.CharField(choices=[('failure', 'Failure'), ('pending', 'Pending'), ('success', 'Success')], default='pending', max_length=10)),
-                ('team', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='webhooks', to='core.team')),
-            ],
-            options={
-                'verbose_name': 'Team webhook',
-                'verbose_name_plural': 'Team webhooks',
-                'db_table': 'people_team_webhook',
-            },
+        migrations.AddConstraint(
+            model_name='contact',
+            constraint=models.CheckConstraint(check=models.Q(('base__isnull', False), ('owner__isnull', True), _negated=True), name='base_owner_constraint', violation_error_message='A contact overriding a base contact must be owned.'),
         ),
         migrations.AddConstraint(
             model_name='contact',
-            constraint=models.CheckConstraint(condition=models.Q(('base__isnull', False), ('owner__isnull', True), _negated=True), name='base_owner_constraint', violation_error_message='A contact overriding a base contact must be owned.'),
-        ),
-        migrations.AddConstraint(
-            model_name='contact',
-            constraint=models.CheckConstraint(condition=models.Q(('base', models.F('id')), _negated=True), name='base_not_self', violation_error_message='A contact cannot be based on itself.'),
+            constraint=models.CheckConstraint(check=models.Q(('base', models.F('id')), _negated=True), name='base_not_self', violation_error_message='A contact cannot be based on itself.'),
         ),
         migrations.AlterUniqueTogether(
             name='contact',
             unique_together={('owner', 'base')},
         ),
         migrations.AddConstraint(
-            model_name='invitation',
-            constraint=models.UniqueConstraint(fields=('email', 'team'), name='email_and_team_unique_together'),
+            model_name='identity',
+            constraint=models.UniqueConstraint(fields=('user', 'email'), name='unique_user_email', violation_error_message='This email address is already declared for this user.'),
         ),
         migrations.AddConstraint(
             model_name='teamaccess',

src/backend/core/migrations/0002_add_organization_and_more.py

@@ -1,62 +0,0 @@
-# Generated by Django 5.1.1 on 2024-10-22 10:07
-
-import core.models
-import django.contrib.postgres.fields
-import django.db.models.deletion
-import uuid
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0001_initial'),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name='Organization',
-            fields=[
-                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
-                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
-                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('name', models.CharField(max_length=100, verbose_name='name')),
-                ('registration_id_list', django.contrib.postgres.fields.ArrayField(base_field=models.CharField(max_length=128), blank=True, default=list, size=None, verbose_name='registration ID list')),
-                ('domain_list', django.contrib.postgres.fields.ArrayField(base_field=models.CharField(max_length=256), blank=True, default=list, size=None, verbose_name='domain list')),
-            ],
-            options={
-                'verbose_name': 'organization',
-                'verbose_name_plural': 'organizations',
-                'db_table': 'people_organization',
-                'constraints': [models.CheckConstraint(condition=models.Q(('registration_id_list__len__gt', 0), ('domain_list__len__gt', 0), _connector='OR'), name='registration_id_or_domain', violation_error_message='An organization must have at least a registration ID or a domain.')],
-            },
-        ),
-        migrations.AddField(
-            model_name='team',
-            name='organization',
-            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='teams', to='core.organization'),
-        ),
-        migrations.AddField(
-            model_name='user',
-            name='organization',
-            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='users', to='core.organization'),
-        ),
-        migrations.CreateModel(
-            name='OrganizationAccess',
-            fields=[
-                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
-                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
-                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('role', models.CharField(choices=[('administrator', 'Administrator')], default='administrator', max_length=20)),
-                ('organization', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='organization_accesses', to='core.organization')),
-                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='organization_accesses', to=settings.AUTH_USER_MODEL)),
-            ],
-            options={
-                'verbose_name': 'Organization/user relation',
-                'verbose_name_plural': 'Organization/user relations',
-                'db_table': 'people_organization_access',
-                'constraints': [models.UniqueConstraint(fields=('user', 'organization'), name='unique_organization_user', violation_error_message='This user is already in this organization.')],
-            },
-        ),
-    ]

src/backend/core/migrations/0003_team_slug_nullable.py

@@ -1,18 +0,0 @@
-# Generated by Django 5.1.2 on 2024-11-04 14:25
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0002_add_organization_and_more'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='team',
-            name='slug',
-            field=models.SlugField(max_length=100, null=True),
-        ),
-    ]

src/backend/core/migrations/0004_remove_team_slug.py

@@ -1,17 +0,0 @@
-# Generated by Django 5.1.3 on 2024-11-20 10:08
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0003_team_slug_nullable'),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name='team',
-            name='slug',
-        ),
-    ]

src/backend/core/migrations/0005_add_serviceprovider.py

@@ -1,39 +0,0 @@
-# Generated by Django 5.1.2 on 2024-11-07 16:24
-
-import uuid
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0004_remove_team_slug'),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name='ServiceProvider',
-            fields=[
-                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
-                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
-                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('name', models.CharField(max_length=256, unique=True, verbose_name='name')),
-                ('audience_id', models.CharField(db_index=True, max_length=256, unique=True, verbose_name='audience id')),
-            ],
-            options={
-                'verbose_name': 'service provider',
-                'verbose_name_plural': 'service providers',
-                'db_table': 'people_service_provider',
-            },
-        ),
-        migrations.AddField(
-            model_name='organization',
-            name='service_providers',
-            field=models.ManyToManyField(blank=True, related_name='organizations', to='core.serviceprovider'),
-        ),
-        migrations.AddField(
-            model_name='team',
-            name='service_providers',
-            field=models.ManyToManyField(blank=True, related_name='teams', to='core.serviceprovider'),
-        ),
-    ]

src/backend/core/migrations/0006_contact_notes_alter_contact_full_name.py

@@ -1,24 +0,0 @@
-# Generated by Django 5.1.3 on 2024-11-28 09:37
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0005_add_serviceprovider'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='contact',
-            name='notes',
-            field=models.TextField(blank=True, default='', verbose_name='notes'),
-        ),
-        migrations.AlterField(
-            model_name='contact',
-            name='full_name',
-            field=models.CharField(default='-', max_length=150, verbose_name='full name'),
-            preserve_default=False,
-        ),
-    ]

src/backend/core/migrations/0007_rename_contact_base_to_override.py

@@ -1,47 +0,0 @@
-# Generated by Django 5.1.3 on 2024-12-02 10:04
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0006_contact_notes_alter_contact_full_name'),
-    ]
-
-    operations = [
-        migrations.RemoveConstraint(
-            model_name='contact',
-            name='base_owner_constraint',
-        ),
-        migrations.RemoveConstraint(
-            model_name='contact',
-            name='base_not_self',
-        ),
-        migrations.AlterUniqueTogether(
-            name='contact',
-            unique_together=set(),
-        ),
-        migrations.AddField(
-            model_name='contact',
-            name='override',
-            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='overridden_by', to='core.contact'),
-        ),
-        migrations.AddConstraint(
-            model_name='contact',
-            constraint=models.CheckConstraint(condition=models.Q(('override__isnull', False), ('owner__isnull', True), _negated=True), name='override_owner_constraint', violation_error_message='A contact overriding a base contact must be owned.'),
-        ),
-        migrations.AddConstraint(
-            model_name='contact',
-            constraint=models.CheckConstraint(condition=models.Q(('override', models.F('id')), _negated=True), name='override_not_self', violation_error_message='A contact cannot override itself.'),
-        ),
-        migrations.RemoveField(
-            model_name='contact',
-            name='base',
-        ),
-        migrations.AlterUniqueTogether(
-            name='contact',
-            unique_together={('owner', 'override')},
-        ),
-    ]

src/backend/core/migrations/0008_change_user_profile_to_contact.py

@@ -1,47 +0,0 @@
-# Generated by Django 5.1.3 on 2024-12-02 10:58
-
-import django.db.models.deletion
-from django.conf import settings
-from django.db import migrations, models
-
-
-def init_profile_contact(apps, schema_editor):
-    """Create a Contact for each User to be used as their profile."""
-    User = apps.get_model("core", "User")
-    Contact = apps.get_model("core", "Contact")
-
-    for user in User.objects.all():  # This is a small table for now
-        Contact.objects.create(
-            owner=user,
-            user=user,
-            full_name=user.name or user.email,
-            data={
-                "emails": [
-                    {"type": "Work", "value": user.email},
-                ],
-            },
-        )
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0007_rename_contact_base_to_override'),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name='user',
-            name='profile_contact',
-        ),
-        migrations.AddField(
-            model_name='contact',
-            name='user',
-            field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='profile_contact', to=settings.AUTH_USER_MODEL),
-        ),
-        migrations.AddConstraint(
-            model_name='contact',
-            constraint=models.CheckConstraint(condition=models.Q(('user__isnull', True), models.Q(('owner', models.F('user')), ('owner__isnull', False)), _connector='OR'), name='profile_contact_owner_constraint', violation_error_message='Users can only declare as profile a contact they own.'),
-        ),
-        migrations.RunPython(init_profile_contact, reverse_code=migrations.RunPython.noop),
-    ]

src/backend/core/migrations/0009_contacts_add_index_on_data_emails.py

@@ -1,18 +0,0 @@
-# Generated by Django 5.1.3 on 2024-12-05 13:19
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0008_change_user_profile_to_contact'),
-    ]
-
-    operations = [
-        # From 100ms to 78ms for 5 000 contacts on my computer
-        # This is not a big improvement and may need further investigation
-        migrations.RunSQL(
-           "CREATE INDEX json_field_index_emails_value ON people_contact USING GIN ((data->'emails'->'value') jsonb_path_ops);"
-        )
-    ]

src/backend/core/migrations/0010_team_depth_team_numchild_team_path_and_more.py

@@ -1,58 +0,0 @@
-# Generated by Django 5.1.3 on 2024-11-26 13:55
-
-from django.db import migrations, models
-
-from treebeard.numconv import NumConv
-
-
-def update_team_paths(apps, schema_editor):
-    Team = apps.get_model("core", "Team")
-    alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
-    steplen = 5
-
-    # Initialize NumConv with the specified custom alphabet
-    converter = NumConv(alphabet)
-
-    nodes = Team.objects.all().order_by("created_at")
-    for i, node in enumerate(nodes, 1):
-        node.depth = 1  # root nodes are at depth 1
-
-        # Use NumConv to encode the index `i` to a base representation and
-        # pad it to the specified step length using the custom alphabet
-        node.path = converter.int2str(i).rjust(steplen, alphabet[0])
-
-    if nodes:
-        Team.objects.bulk_update(nodes, ["depth", "path"])
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0009_contacts_add_index_on_data_emails'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='team',
-            name='depth',
-            field=models.PositiveIntegerField(default=0),
-            preserve_default=False,
-        ),
-        migrations.AddField(
-            model_name='team',
-            name='numchild',
-            field=models.PositiveIntegerField(default=0),
-        ),
-        migrations.AddField(
-            model_name='team',
-            name='path',
-            field=models.CharField(default='', max_length=400, db_collation="C"),
-            preserve_default=False,
-        ),
-        migrations.RunPython(update_team_paths, migrations.RunPython.noop),
-        migrations.AlterField(
-            model_name="team",
-            name="path",
-            field=models.CharField(unique=True, max_length=400, db_collation="C"),
-        ),
-    ]

src/backend/core/migrations/0011_team_is_visible_all_services.py

@@ -1,18 +0,0 @@
-# Generated by Django 5.1.7 on 2025-03-11 13:34
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0010_team_depth_team_numchild_team_path_and_more'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='team',
-            name='is_visible_all_services',
-            field=models.BooleanField(default=False, help_text='Whether this team is visible to all service providers.', verbose_name='is visible for all SP'),
-        ),
-    ]

src/backend/core/migrations/0012_organization_metadata.py

@@ -1,18 +0,0 @@
-# Generated by Django 5.1.7 on 2025-03-10 14:08
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0011_team_is_visible_all_services'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='organization',
-            name='metadata',
-            field=models.JSONField(blank=True, default=dict, help_text='A JSON object containing the organization metadata', verbose_name='metadata'),
-        ),
-    ]

src/backend/core/migrations/0013_organization_is_active.py

@@ -1,18 +0,0 @@
-# Generated by Django 5.1.7 on 2025-03-27 10:03
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0012_organization_metadata'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='organization',
-            name='is_active',
-            field=models.BooleanField(default=True, verbose_name='active'),
-        ),
-    ]

src/backend/core/migrations/0014_accountservice.py

@@ -1,32 +0,0 @@
-# Generated by Django 5.1.8 on 2025-04-03 20:37
-
-import core.models
-import django.contrib.postgres.fields
-import uuid
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0013_organization_is_active'),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name='AccountService',
-            fields=[
-                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
-                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
-                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('name', models.CharField(max_length=255, verbose_name='name')),
-                ('api_key', models.CharField(default='Y9-IThtCrKASOvRAKO2MUBd_XvZrnSTGNMMlv-Z1_o8', max_length=255, verbose_name='api key')),
-                ('scopes', django.contrib.postgres.fields.ArrayField(base_field=models.CharField(max_length=255, validators=[core.models.validate_account_service_scope]), help_text='Allowed scopes for this service', size=None, verbose_name='allowed scopes')),
-            ],
-            options={
-                'verbose_name': 'Account service',
-                'verbose_name_plural': 'Account services',
-                'db_table': 'people_account_service',
-            },
-        ),
-    ]

src/backend/core/migrations/0015_alter_accountservice_api_key.py

@@ -1,18 +0,0 @@
-# Generated by Django 5.1.8 on 2025-04-10 07:19
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0014_accountservice'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='accountservice',
-            name='api_key',
-            field=models.CharField(max_length=255, verbose_name='api key'),
-        ),
-    ]

src/backend/core/migrations/0016_team_external_id_alter_team_users.py

@@ -1,40 +0,0 @@
-# Generated by Django 5.2 on 2025-06-12 09:58
-
-import uuid
-from django.conf import settings
-from django.db import migrations, models
-
-
-def gen_team_uuid(apps, schema_editor):
-    Team = apps.get_model("core", "Team")
-    for row in Team.objects.all():
-        row.external_id = uuid.uuid4()
-        # Don't need to batch update here, as the table is likely small or empty
-        row.save(update_fields=["external_id"])
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0015_alter_accountservice_api_key'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='team',
-            name='external_id',
-            field=models.UUIDField(default=uuid.uuid4, editable=False, help_text='Team external UUID for synchronization with external systems', unique=False, verbose_name='external_id'),
-        ),
-        migrations.RunPython(gen_team_uuid, reverse_code=migrations.RunPython.noop),
-        migrations.AlterField(
-            model_name='team',
-            name='external_id',
-            field=models.UUIDField(default=uuid.uuid4, editable=False, help_text='Team external UUID for synchronization with external systems', unique=True, verbose_name='external_id'),
-        ),
-        #
-        migrations.AlterField(
-            model_name='team',
-            name='users',
-            field=models.ManyToManyField(related_name='teams', through='core.TeamAccess', through_fields=('team', 'user'), to=settings.AUTH_USER_MODEL),
-        ),
-    ]

src/backend/core/migrations/0017_teamwebhook_protocol.py

@@ -1,18 +0,0 @@
-# Generated by Django 5.2.3 on 2025-06-17 14:23
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0016_team_external_id_alter_team_users'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='teamwebhook',
-            name='protocol',
-            field=models.CharField(choices=[('scim', 'Scim'), ('matrix', 'Matrix')], default='scim'),
-        ),
-    ]